Data Sheet 





CYRIX Cx486SLC/e MICROPROCESSOR 

High-Performance 486-Style CPU with Advanced Power 
Managementfor Notebook and Battery-Powered Systems 



Cx486SLC/e Data Sheet 




486 PERFORMANCE 

- Up to 2.4 times faster than 386SL at same frequency 

- Landmark 2.0=107 MHz, Norton SI 6.0 = 52 at 33 MHz 

- On-chip hardware multiplier accelerates graphics 

- Clock speeds up to 33 MHz 

486-STYLE ARCHITECTURE 

- Single-cycle RISC-like 32-bit integer core 

- Integrated instruction and data cache 

- Executes 486SX instruction set 

- Runs DOS, Windows, OS/2, Unix 

SMALL 100-PIN QFP PACKAGE 

- Compatible with 16-bit 386SX bus interface 

allowing compact system design 

- Companion low-power QFP math coprocessor 



ADVANCED POWER MANAGEMENT 

- Software or hardware initiated low-power suspend mode 

- Full static design permits stop clock state 

- On-chip cache significantly reduces power-consuming 

external memory accesses 

- 3 V and 5 V versions 

SYSTEM MANAGEMENT MODE 

- High priority SMI interrupt and separate memory 

address space 

- Facilitates system-wide power management for 

maximum battery life 

- Rapid SMI service routine entry and exit 

- I/O trapping for power management of peripherals 



The Cyrix Cx486SLC/e is an enhanced version of the 
Cx486SLC specifically designed for demanding battery- 
powered applications. The Cx486SLC/e offers high 
performance integrated with advanced features for both 
CPU power management and system- wide power 
management. 



The Cx486SLC/e's System Management Mode (SMM) 
provides a high priority interrupt, I/O trapping and a 
separate address space used to enhance and simplify 
power management software. Fast entry, and exit of 
SMM allows frequent use of this feature without perfor- 
mance degradation. 



High performance is achieved through use of a single 
cycle execution unit and a 32-bit internal data path that 
couple tightly to an on-chip instruction/data cache. This 
architecture results in up to 2 to 3 times the performance 
of conventional 386SL notebook CPUs. Additionally, the 
on-chip cache reduces overall system power by minimiz- 
ing external memory accesses. 



Additionally, the CPU's power consumption can be 
minimized through use of easy-to-design suspend/resume 
functionality augmented by a static CPU core. When 
active, these features result in a significant reduction in 
CPU power (0.1% of active power) . The 3V version 
consumes less than one third the power of the 5V device. 
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1.1 



PRODUCT OVERVIEW 



Introduction 



1.2 



Execution Pipeline 



The Cyrix® Cx486SLC/e™ microprocessor is an 
advanced 32-bit X86 compatible processor 
offering high performance and integrated power 
management on a single chip. The Cx486SLC/e is 
486SX instruction set compatible and is backward 
compatible with the 386SX pinout. This CPU 
provides up to 2 or 3 times the performance of 
conventional 386SL and 386SX notebook com- 
puters at equal clock frequencies. 

The Cx486SLC/e is an ideal solution for battery- 
powered applications in that it typically draws 
0.40 mA while the input clock is stopped in 
suspend mode. Additionally, the Cyrix 
Cx486SLC/e System Management Mode (SMM) 
can be used for system power management or 
software emulation of I/O peripheral devices. The 
Cx486SLC/e-V version of the CPU offers addi- 
tional power savings as it operates on a 3-volt as 
well as 5-volt power supply. 

The Cx486SLC/e supports 8, 16 and 32-bit data 
types and operates in real, virtual 8086 and 
protected modes. This microprocessor achieves 
high performance through the use of a highly 
optimized variable length pipeline combined with 
a RISC-like single cycle execution unit, an on-chip 
hardware multiplier and an integrated instruction 
and data cache. The Cx486SLC/e is available at 
operating frequencies of 20, 25 and 33 MHz. 



The Cx486SLC/e execution path consists of five 
pipelined stages that are optimized for minimal 
instruction cycle times. These five stages are: 

• Code Fetch 

o Instruction Decode 

o Microcode ROM Access 

o Execution 

• Memory/Register File Write-Back. 

Each stage is designed with hardware interlocks 
which permit successive instruction execution 
overlap. 

The 16-byte instruction prefetch queue fetches 
code in advance and prepares it for decode, 
helping to minimize overall execution time. The 
instruction decoder then decodes four bytes of 
instructions per clock eliminating the need for a 
queue of decoded instructions. Sequential 
instructions are decoded quickly and passed on to 
the microcode ROM stage of the pipeline. Non- 
sequential operations do not have to wait for a 
queue of decoded instructions to be flushed and 
refilled before execution continues. As a result, 
both sequential and non-sequential instruction 
execution times are minimized. 

The execution stage takes advantage of a RISC- 
like single cycle execution unit and a 16-bit 
hardware multiplier. The write-back stage 
provides single cycle 32-bit access to the on-chip 
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On-Chip Cache 



cache and posts all writes to the cache and system 
bus using a two-deep write buffer. Posted writes 
allow the execution unit to proceed with program 
execution while the bus interface unit actually 
completes the write cycle. 



1.3 



On-Chip Cache 



The Cx486SLC/e on-chip cache maximizes overall 
performance by quickly supplying instructions and 
data to the internal execution pipeline. On a 
386SX system, an external memory access takes a 
minimum of two clock cycles (zero wait states). 
For cache hits, the Cx486SLC/e eliminates these 
two clock cycles by overlapping cache accesses 
with normal execution pipeline activity. Addi- 
tional bus bandwidth is gained by presenting 
instructions and data to the execution pipeline up 
to 32 bits at a time compared to 16 bits per cycle 
for an external memory access. 

The Cx486SLC/e cache is a 1 KByte write-through 
unified instruction and data cache. New lines are 
allocated only during memory read cycles. The 
cache can be configured as direct-mapped or as 
two-way set associative. The direct-mapped 
organization is a single set of 256 four-byte lines. 
When configured as two-way set associative, the 
cache organization consists of two sets of 128 four- 
byte lines and uses a Least Recently Used (LRU) 
replacement algorithm. 



1 .4 Power Management 

1.4.1 Suspend Mode and Static 
Operation 

The Cx486SLC/e power management features 
allow a dramatic reduction in current consump- 
tion when the CPU is in suspend mode (typically 
less than 2 percent of the operating current). 
Suspend mode is entered either by a hardware or 
software initiated action. Using the hardware to 
initiate suspend mode involves a two-pin hand- 
shake using the SUSP# and SUSPA# signals. The 
software initiates suspend mode through execu- 
tion of the HALT instruction. Once in suspend 
mode, the Cx486SLC/e power consumption can 
be further reduced by stopping the external clock 
input. The resulting current draw is typically 
0.40 mA. Since the Cx486SLC/e is a static device, 
no internal CPU data is lost when the clock input 
is stopped. 



1 .4.2 3-Volt Operation 

The Cx486SLC/e-V version of the Cx486SLC/e 
operates from either a 3-volt or a 5-volt supply. 
While operating with a 3-volt supply, the power 
consumed by the 486SLC-V is typically only 
30 percent of the power consumed while operating 
at 5 volts. 
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1.5 System Management 
Mode 

System Management Mode (SMM) provides an . 
additional interrupt and a separate address space 
which can be used for system power management 
or software transparent emulation of I/O peripher- 
als. SMM is entered using the System Manage- 
ment Interrupt (SM1#) which has a higher priority 
than any other interrupt. While running in 
protected SMM address space, the SMI interrupt 
routine can execute without interfering with the 
operating system or application programs. 

After reception of an SM1#, portions of the CPU 
state are automatically saved, SMM is entered and 
program execution begins at the base of SMM 
address space. The location and size of the SMM 
memory is programmable within the 
Cx486SLC/e. Seven SMM instructions have been 
added to the 486SX instruction set that permit 
saving and restoring of the total CPU state when 
in SMM mode. 
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1 .6 Signal Summary 



The Cx486SLC/e includes two power management signals (SUSP# and SUSPA#), four cache interface 
signals (FLUSH#, KEN#, RPLSET, and RPLVAL#), an A20 mask input (A20M#) and two SMM 
signals (SMADS# and SMI#) that are additions to the 386SX signal set. The complete list of 
Cx486SLC/e signals is shown in Figure 1-1. 




(1) = Internal Cache Interface 

(2) = Power Management 

(3) = A20 Mask 

(4) = System Management Mode 
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2. PROGRAMMING 
INTERFACE 

In this chapter, the internal operations of the 
Cx486SLC/e are described mainly from an 
application programmer's point of view. Included 
in this chapter are descriptions of processor 
initialization, the register set, memory addressing, 
various types of interrupts and the shutdown, and 
halt process. Also included is an overview of real, 
virtual 8086, and protected operating modes. 

2.1 Processor 

Initialization 

The Cx486SLC/e is initialized when the RESET 
signal is asserted. The processor is placed in real 
mode and the registers listed in Table 2-1 are set 
to their initialized values. RESET invalidates and 
disables the Cx486SLC/e cache, and turns off 



paging. When RESET is asserted, the 
Cx486SLC/e terminates all local bus activity and 
all internal execution. During the entire time that 
RESET is asserted, the internal pipeline is flushed 
and no instruction execution or bus activity 
occurs. 

Approximately 350 to 450 CLK2 clock cycles 
(additional 2 20 + 60 if self-test is requested) after 
RESET is negated, the processor begins executing 
instructions at the top of physical memory (ad- 
dress location FF FFFOh). When the first interseg- 
ment JUMP or CALL is executed, address lines 
A23-A20 are driven low for code segment-relative 
memory access cycles. While A23-A20 are low, 
the Cx486SLC/e executes instructions only in the 
lowest 1 MByte of physical address space until 
system-specific initialization occurs via program 
execution. 



PRELIMINARY 



2-1 




Processor Initialization 



Table 2-1 . Initialized Register Contents 



REGISTER 


REGISTER NAME 


INITIALIZED CONTENTS 


COMMENTS 


EAX 


Accumulator 


xxxxxxxxh 


0000 OOOOh indicates self-test 
passed. 


EBX 


Base 


xxxxxxxxh 




ECX 


Count 


xxxxxxxxh 




EDX 


Data 


xxxx 0400 + Revision ID 


Revision ID = 1 lh. 


EBP 


Base Pointer 


xxxxxxxxh 




ESI 


Source Index 


xxxxxxxxh 




EDI 


Destination Index 


xxxxxxxxh 




ESP 


Stack Pointer 


xxxxxxxxh 




EFLAGS 


Flag Word 


0000 0002h 




EIP 


Instruction Pointer 


0000 FFFOh 




ES 


Extra Segment 


OOOOh 


Base address set to 0000 OOOOh. 
Limit set to FFFFh. 


CS 


Code Segment 


FOOOh 


Base address set to FFFF OOOOh. 
Limit set to FFFFh. 


SS 


Stack Segment 


OOOOh 


Base address set to 0000 OOOOh. 
Limit set to FFFFh 


DS 


Data Segment 


OOOOh 


Base address set to 0000 OOOOh. 
Limit set to FFFFh. 


FS 


Extra Segment 


OOOOh 


Base address set to 0000 OOOOh. 
Limit set to FFFFh 


GS 


Extra Segment 


OOOOh 


Base address set to 0000 OOOOh. 
Limit set to FFFFh 


IDTR 


Interrupt Descriptor Table 
Register 


Base = 0, Limit = 3FFh 




CRO 


Machine Status Word 


0000 OOlOh 




CCRO 


Configuration Control 


OOh 




CCR1 


Configuration Control 1 


OOh 




ARR1 


Address Region 1 


OOOFh 


4-GByte non-cacheable region. 


ARR2 


Address Region 2 


OOOOh 




ARR3 


Address Region 3 


OOOOh 




ARR4 


Address Region 4 


OOOOh 




DR7 


Debug Register DR7 


0000 0400h 





Note: x'= Undefined value 
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2.2 Instruction Set Overview 

The Cx486SLC/e instruction set can be divided 
into eight types of operations: 

Arithmetic 
Bit Manipulation 
Control Transfer 
Data Transfer 

High-Level Language Support 

Operating System Support 

Shift/Rotate 

String Manipulation. 

All Cx486SLC/e instructions operate on as few as 
operands and as many as 3 operands. A NOP 
instruction (no operation) is an example of a 
operand instruction. Two operand instructions 
allow the specification of an explicit source and 
destination pair as part of the instruction. These 
two operand instructions can be divided into 
eight groups according to operand types: 

Register to Register 
Register to Memory 
Memory to Register 
Memory to Memory 
Register to I/O 
I/O to Register 
Immediate Data to Register 
Immediate Data to Memory. 

An operand can be held in the instruction itself 
(as in the case of an immediate operand), in a 
register, in an I/O port or in memory. An 
immediate operand is prefetched as part of the 
opcode for the instruction. 

Operand lengths of 8, 16, or 32 bits are sup- 
ported. Operand lengths of 8 or 32 bits are 



generally used when executing code written for 
386- or 486-class (32-bit code) processors. 
Operand lengths of 8 or 16 bits are generally used 
when executing existing 8086 or 80286 code (16- 
bit code). The default length of an operand can 
be overridden by placing one or more instruction 
prefixes in front of the opcode. For example, by 
using prefixes, a 32-bit operand can be used with 
16-bit code or a 16-bit operand can be used with 
32-bit code. 

Chapter 6 of this manual lists each instruction in 
the Cx486SLC/e instruction set along with the 
associated opcodes, execution clock counts and 
effects on the FLAGS register. 

2.2.1 Lock Prefix 

The LOCK prefix may be placed before certain 
instructions that read, modify, then write back to 
memory. The prefix asserts the LOCK# signal to 
indicate to the external hardware that the CPU is 
in the process of running multiple indivisible 
memory accesses. The LOCK prefix can be used 
with the following instructions: 

Bit Test Instructions (BTS, BTR, BTC) 
Exchange Instructions (XADD, XCHG, 

CMPXCHG) 
One-operand Arithmetic and Logical 

Instructions (DEC, INC, NEG, NOT) 
Two-operand Arithmetic and Logical 

Instructions (ADC, ADD, AND, OR, SBB, 

SUB, XOR). 

An invalid opcode exception is generated if the 
LOCK prefix is used with any other instruction, 
or with the above instructions when no write 
operation to memory occurs (i. e., the destination 
is a register). 
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2.3 Register Set 

There are 43 accessible registers in the 
Cx486SLC/e and these registers are grouped into 
two sets. The application register set contains the 
registers frequently used by application program- 
mers, and the system register set contains the 
registers typically reserved for use by operating 
systems programmers. 

The application register set is made up of: 

Eight 32-bit general purpose registers. 

Six 16-bit segment registers. 

One 32-bit flag register. 

One 32-bit instruction pointer register. 

The system register set is made up of the remain- 
ing registers which include: 

Three 32-bit control registers. 

Two 48-bit and two 16-bit system address 

registers. 
Six 32-bit debug registers. 
Two 8-bit and four 16-bit configuration 

registers. 
Five 32-bit test registers. 

Each of the registers is discussed in detail in the 
following sections. 

2.3. 1 Application Register Set 

The application register set (Figure 2-1) consists 
of the registers most often used by the applica- 
tions programmer. These registers are generally 
accessible and are not protected from read or 
write access. 

The General Purpose Registers contents are 
frequently modified by assembly language in- 
structions and typically contain arithmetic and 
logical instruction operands. 



The Segment Registers contain segment selec- 
tors, which index into tables located in memory. 
These tables hold the base address for each 
segment, as well as other information related to 
memory addressing. 

The Flag Register contains control bits used to 
reflect the status of previously executed instruc- 
tions. This register also contains control bits that 
effect the operation of some instructions. 

The Instruction Pointer register points to the 
next instruction that the processor will execute. 
This register is automatically incremented by the 
processor as execution progresses. 

2.3.1.1 General Purpose 
Registers 

The general purpose registers are divided into four 
data registers, two pointer registers, and two index 
registers as shown in Figure 2-2. 

The data registers are used by the applications 
programmer to manipulate data structures and to 
hold the results of logical and arithmetic opera- 
tions. Different portions of the general data 
registers can be addressed by using different 
names. An "E" prefix identifies the complete 
32-bit register. An "X" suffix without the "E" 
prefix identifies the lower 16 bits of the register. 
The lower two bytes of the register can be ad- 
dressed with an "H" suffix to identify the upper 
byte or an "L" suffix to identify the lower byte. 
When a destination operand size specified by an 
instruction is smaller than the specified destination 
register, the other bytes of the destination register 
are not affected when the operand is written to the 
register. 
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Figure 2- 1 • Application Register Set 



The pointer and index registers are listed 
below: 



SI or ESI 
DI or EDI 
SP or ESP 
BP or EBP 



Source Index 
Destination Index 
Stack Pointer 
Base Pointer 



These registers can be addressed as 16- or 32-bit 
registers, with the "E" prefix indicating 32 bits. 
The pointer and index registers can be used as 
general purpose registers, however, some instruc- 
tions use a fixed assignment of these registers. For 
example, repeated string operations always use 
ESI as the source pointer, EDI as the destination 
pointer, and ECX as a counter. The instructions 
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using fixed registers include double-precision 
multiply and divide, I/O access, string operations, 
translate, loop, variable shift and rotate, and stack 
operations. 

The Cx486SLC/e processor implements a stack 
using the ESP register. This stack is accessed 
during the PUSH and POP instructions, procedure 
calls, procedure returns, interrupts, exceptions, and 



interrupt/exception returns. The microprocessor 
automatically adjusts the value of the ESP during 
operation of these instructions. 
The EBP register may be used to reference data 
passed on the stack during procedure calls.. Local 
data may also be placed on the stack and refer- 
enced relative to BP. This register provides a 
mechanism to access stack data in high-level 
languages. 
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2.3. 1 .2 Segment Registers and 
Selectors 

Segmentation provides a means of defining data 
structures inside the memory space of the micro- 
processor. There are three basic types of seg- 
ments: code, data, and stack. Segments are used 
automatically by the processor to determine the 
location in memory of code, data, and stack > 
references. 

There are six 16-bit segment registers: 

CS Code Segment 

DS Data Segment 

ES Extra Segment 

SS Stack Segment 

FSAdditional Data Segment 
GS Additional Data Segment. 

In real and virtual 8086 operating modes, a 
segment register holds a 16-bit segment base. 
The 16-bit segment base is multiplied by 16 and a 
16-bit or 32-bit offset is then added to it to create 
a linear address. The offset size is dependent on 
the current address size. In real mode and in 
virtual 8086 mode with paging disabled, the 
linear address is also the physical address. In 
virtual 8086 mode with paging enabled, the linear 



address is translated to the physical address using 
the current page tables. 

In protected mode, a segment register holds a 
segment selector containing a 13-bit index, a 
table indicator (TI) bit, and a two-bit requested 
privilege level (RPL) field as shown in Figure 2-3. 

The Index points into a descriptor table in 
memory and selects one of 8192 (2 13 ) segment 
descriptors contained in the descriptor table. A 
segment descriptor is an eight-byte value used to 
describe a memory segment by defining the 
segment base, the segment limit,' and access 
control information. To address data within a 
segment, a 16-bit or 32-bit offset is added to the 
segment's base address. Once a segment selector 
has been loaded into a segment register, an 
instruction needs to specify the offset only. 

The Table Indicator (TI) bit of the selector, 
defines which descriptor table the index points 
into. If TI=0, the index references the Global 
Descriptor Table (GDT). If TI=1, the index 
references the Local Descriptor Table (LDT). The 
GDT and LDT are described in more detail later 
in this chapter. 
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Figure 2-3. Segment Selector 
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The Requested Privilege Level (RPL) field 
contains a 2-bit segment privilege level (00=most 
privileged, 11= least privileged). The RPL bits are 
used when the segment register is loaded to 
determine the Effective Privilege Level (EPL). If 
the RPL bits indicate less privilege than the pro- 
gram, the RPL overrides the current privilege level 
and the EPL is the lower privilege level. If the RPL 
bits indicate more privilege than the program, the 
current privilege level overrides the RPL and again 
the EPL is the lower privilege level. 

When a segment register is loaded with a segment 
selector, the segment base, segment limit and 
access rights are also loaded from the descriptor 
table into a user-invisible or hidden portion of the 
segment register, i.e., cached on-chip. The CPU 
does not access the descriptor table again until 



another segment register load occurs. If the 
descriptor tables are modified in memory, the 
segment registers must be reloaded with the new 
selector values. 

The processor automatically selects a default 
segment register for memory references. Table 2-2 
describes the selection rules. In general, data 
references use the selector contained in the DS 
register, stack references use the SS register and 
instruction fetches use the CS register. While 
some of these selections may be overridden, 
instruction fetches, stack operations, and the 
destination write of string operations cannot be 
overridden. Special segment override prefixes 
allow the use of alternate segment registers 
including the use of the ES, FS, and GS segment 
registers. 



Table 2-2. Segment Register Selection Rules 



TYPE OF MEMORY REFERENCE 


IMPLIED (DEFAULT) 
SEGMENT 


SEGMENT OVERRIDE PREFIX 


Code Fetch 


CS 


None 


Destination of PUSH, PUSHF, INT, CALL, 
PUSHA instructions 


SS 


None 


Source of POP, POPA, POPF, IRET, 
RET instructions 


ss 


None 


Destination of STOS, MOVS, REP 
STOS, REP MOVS instructions 


ES 


None 


Other data references with effective 
address using base registers of: 
EAX, EBX, ECX, 
EDX, ESI, EDI 
EBP,ESP 


DS . 
SS 


CS, ES, FS, GS, SS 
CS, DS, ES, FS, GS 
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2.3. 1.3 Instruction Pointer 
Register 

The Instruction Pointer (EIP) register contains the 
offset into the current code segment of the next 
instruction to be executed. The register is nor- 
mally incremented with each instruction execu- 
tion unless implicitly modified through an inter- 
rupt, exception or an instruction that changes the 
sequential execution flow (e.g., jump, call). 



2.3. 1.4 Flags Register 

The Flags Register, EFLAGS, contains status 
information and controls certain operations on 
the Cx486SLC/e microprocessor. The lower 16 
bits of this register are referred to as the FLAGS 
register that is used when executing 8086 or 
80286 code. The flag bits are shown in 
Figure 2-4 and defined in Table 2-3. 
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Table 2-3. E FLAGS Bit Definitions 



BIT 
POSITION 


NAME 


FUNCTION 





CF 


Carry Flag: Set when a carry out of (addition) or borrow into (subtraction) the most 
significant bit of the result occurs; cleared otherwise. 


2 


PF 


Parity Flag: Set when the low-order 8 bits of the result contain an even number of ones; 
cleared otherwise. 


4 


AF 


Auxiliary Carry Flag: Set when a carry out of (addition) or borrow into (subtraction) 
bit position 3 of the result occurs; cleared otherwise. 


6 


ZF 


Zero Flag: Set if result is zero; cleared otherwise. 


7 


SF 


Sign Flag: Set equal to high-order bit of result (0 indicates positive, 1 indicates negative). 


8 


TF 


Trap Enable Flag: Once set, a single-step interrupt occurs after the next instruction 
completes execution. TF is cleared by the single-step interrupt. 


9 


IF 


Interrupt Enable Flag: When set, maskable interrupts (INTR input pin) are acknowledged 
and serviced by the CPU. 


10 


DF 


Direction Flag: When cleared, DF causes string instructions to auto-increment (default) 
the appropriate index registers (ESI and/or EDI). Setting DF causes auto-decrement of 
the index registers to occur. 


11 


OF 


Overflow Flag: Set if the operation resulted in a carry or borrow into the sign bit of the 
result but did not result in a carry or borrow out of the high-order bit. Also set if the 
operation resulted in a carry or borrow out of the high-order bit but did not result in a 
carry or borrow into the sign bit of the result. 


12, 13 


IOPL 


I/O Privilege Level: While executing in protected mode, IOPL indicates the maximum 
current privilege level (CPL) permitted to execute I/O instructions without generating an 
exception 13 fault or consulting the I/O permission bit map. IOPL also indicates the 
maximum CPL allowing alteration of the IF bit when new values are popped into the 
EFLAGS register. 


14 


NT 


Nested Task: While executing in protected mode, NT indicates that the execution of the 
current task is nested within another task. 


16 


RF 


Resume Flag: Used in conjunction with debug register breakpoints. RF is checked at 
instruction boundaries before breakpoint exception processing. If set, any debug fault is 
ignored on the next instruction. 


17 


VM 


Virtual 8086 Mode: If set while in protected mode, the microprocessor switches to virtual 
8086 operation handling segment loads as the 8086 does, but generating exception 13 
faults on privileged opcodes. The VM bit can be set by the IRET instruction (if current 
privilege level=0) or by task switches at any privilege level. 


18 


AC 


Alignment Check Enable: In conjunction with the AM flag in CR0, the AC flag determines 
whether or not misaligned accesses to memory cause a fault. If AC is set, alignment faults 
are enabled. 
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2.3.2 System Register Set 

The system register set (Figure 2-5) consists of 
registers not generally used by application pro- 
grammers. These registers are typically employed 
by system level programmers who generate 
operating systems and memory management 
programs. 

The Control Registers control certain aspects of 
the Cx486SLC/e microprocessor such as paging, 
coprocessor functions, and segment protection. 
When a paging exception occurs while paging is 
enabled, the control registers retain the linear 
address of the access that caused the exception. 

The Descriptor Table Registers and the Task 
Register can also be referred to as system address 
or memory management registers. These registers 
consist of two 48-bit and two 16-bit registers. 
These registers specify the location of the data 
structures that control the segmentation used by 
the Cx486SLC/e microprocessor. Segmentation is 
one available method of memory management. 



The Configuration Registers are used to control 
the Cx486SLC/e on-chip cache operation, power 
management features and System Management 
Mode. The cache, power management and 
SMM features can be enabled or disabled by 
writing to these registers. Non-cacheable areas 
and write-protected areas of physical memory are 
also defined through the use of these registers. 

The Debug Registers provide debugging facilities 
for the Cx486SLC/e microprocessor and enable 
the use of data access breakpoints and code execu- 
tion breakpoints. 

The Test Registers provide a mechanism to test 
the contents of both the on-chip 1 KByte cache 
and the translation lookaside buffer (TLB). The 
TLB is used as a cache for translating linear 
addresses to physical addresses when paging is 
enabled. In the following sections, the system 
register set is described in greater detail. 
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Figure 2-5. System Register Set 
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2.3.2.1 Control Registers 

The control registers (CRO, CR2 and CR3), are 
shown in Figure 2-6. The CRO register contains 
system control flags which control operating 
modes and indicate the general state of the CPU. 
The lower 16 bits of CRO are referred to as the 
machine status word (MSW). The CRO bit 
definitions are described in Table 2-4. The re- 
served bits in CRO should not be modified. 

When paging is enabled and a page fault is gener- 
ated, the CR2 register retains the 32-bit linear 



address of the address that caused the fault. CR3 
contains the 20-bit base address of the page 
directory. The page directory must always be 
aligned to a 4 KByte page boundary, therefore, the 
lower 12 bits of CR3 are reserved. 

When operating in protected mode, any program 
can read the control registers. However, only 
privilege level (most privileged) programs can 
modify the contents of these registers. 
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Figure 2-6. Control Registers 
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Table 2-4. CRO Bit Definitions 



BIT 
POSITION 


NAME 


FUNCTION 





PE 


Protected Mode Enable: Enables the segment based protection mechanism. If PE=1, 
protected mode is enabled. If PE=0, the CPU operates in real mode, with segment based 
protection disabled, and addresses are formed as in an 8086-class CPU. 


1 


MP 


Monitor Processor Extension: If MP=1 and TS=1, a WAIT instruction causes fault 7. The 
TS bit is set to 1 on task switches by the CPU. Floating point instructions are not affected 
by the state of the MP bit. The MP bit should be set to one during normal operations. 


2 


EM 


Emulate Processor Extension: If EM=1 , all floating point instructions cause a fault 7. 


3 . 


TS , 


Task Switched: Set whenever a task switch operation is performed. Execution of a floating 
point instruction with TS=1 causes a device not available (DNA) fault. If MP=1 and TS=1, 
a WAIT instruction also causes a DNA fault. 


4 


1 


Reserved: Do not attempt to modify. 


5 





Reserved: Do not attempt to modify. 


16 


WP 


Write Protect: Protects read-only pages from supervisor write access. The 386-type CPU 
allows a read-only page to be written from privilege level 0-2. The Cx486SLC/e CPU is 
compatible with the 386-type CPU when WP=0. WP=1 forces a fault on a write to a read- 
only page from any privilege level. 


18 


AM 


Alignment Check Mask: If AM=1, the AC bit in the EFLAGS register is unmasked and 
allowed to enable alignment check faults. Setting AM=0 prevents AC faults from occur- 
ring. 


29 





Reserved: Do not attempt to modify. 


30 


CD 


Cache Disable: If CD=1, no further cache fills occur. However, data already present in the 
cache continues to be used if the requested address hits in the cache. The cache must also 
be invalidated to completely disable any cache activity. 


31 


PG 


Paging Enable Bit: If PG=1 and protected mode is enabled (PE=1), paging is enabled. 
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2.3.2.2 Descriptor Table 

Registers and Descriptors 

Descriptor Table Registers 

The Global, Interrupt and Local Descriptor Table 
Registers (GDTR, 1DTR and LDTR), shown in 
Figure 2-7, are used to specify the location of the 
data structures that control segmented memory 
management. The GDTR, IDTR and LDTR are 
loaded using the LGDT, LIDT and LLDT instruc- 
tions, respectively. The values of these registers 
are stored using the corresponding store instruc- 
tions. The GDTR and IDTR load instructions are 
privileged instructions when operating in pro- 
tected mode. The LDTR can only be accessed in 
protected mode. 

The Global Descriptor Table Register (GDTR) 
holds a 32-bit base address and 16-bit limit for the 
Global Descriptor Table (GDT). The GDT is an 
array of up to 8192 8-byte descriptors. When a 
segment register is loaded from memory, the TI 
bit in the segment selector chooses either the GDT 
or the local descriptor table (LDT) to locate a 
descriptor. If TI = 0, the index portion of the 
selector is used to locate a given descriptor within 



the GDT table. The contents of the GDTR are 
completely visible to the programmer. The first 
descriptor in the GDT (location 0) is not used by 
the CPU and is referred to as the "null descriptor". 
If the GDTR is loaded while operating in 16-bit 
operand mode, the Cx486SLC/e accesses a 32-bit 
base value but the upper 8 bits are ignored result- 
ing in a 24-bit base address. 

The Interrupt Descriptor Table Register 

(IDTR) holds a 32-bit base address and 16-bit 
limit for the Interrupt Descriptor Table (IDT). 
The IDT is an array of 256 8-byte interrupt 
descriptors, each of which is used to point to an 
interrupt service routine. Every interrupt that 
may occur in the system must have an associated 
entry in the IDT. The contents of the IDTR are 
completely visible to the programmer. 

The Local Descriptor Table Register (LDTR) 
holds a 16-bit selector for the Local Descriptor 
Table (LDT). The LDT is an array of up to 8192 
8-byte descriptors. When the LDTR is loaded, the 
LDTR selector indexes an LDT descriptor that 
must reside in the global descriptor table (GDT). 
The contents of the selected descriptor are cached 
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on-chip in the hidden portion of the LDTR. The 
CPU does not access the GDT again until the 
LDTR is reloaded. If the LDT description is 
modified in memory in the GDT, the LDTR must 
be reloaded to update the hidden portion of the 
LDTR. 

When a segment register is loaded from memory, 
the TI bit in the segment selector chooses either 
the GDT or the LDT to locate a segment descrip- 
tor. If TI = 1 , the index portion of the selector is 
used to locate a given descriptor within the LDT. 
Each task in the system may be given its own 
LDT, managed by the operating system. The 
LDTs provide a method of isolating a given task's 
segments from other tasks in the system. 



Descriptors 

There are three types of descriptors: 

• Application Segment Descriptors that define 
code, data and stack segments 

• System Segment Descriptors that define an 
LDT segment or a TSS 

• Gate Descriptors that define task gates, 
interrupt gates, trap gates and call gates. 

Application Segment Descriptors can be located in 
either the LDT or GDT. System Segment De- 
scriptors can only be located in the GDT. Depen- 
dent on the gate type, gate descriptors may be 
located in either the GDT, LDT or IDT. Figure 2- 
8 illustrates the descriptor format for both Applica- 
tion Segment Descriptors and System Segment 
Descriptors and Table 2-5 lists the corresponding 
bit definitions. 
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Figure 2-8. Application and System Segment Descriptors 
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Table 2-5. Segment Descriptor Bit Definitions 



BIT 
POSITION 


MEMORY 
OFFSET 


NAME 


DESCRIPTION 


31-24 

7-0 
31-16 


+4 
+4 
+0 


BASE 


Segment base address. 

32-bit linear address that points to the beginning of the segment. 


19-16 
15-0 


+4 
+0 


LIMIT 


Segment limit. In real mode, the default segment limit is always 
64 KBytes (OFFFFh). 


23 


+4 


G 


Limit granularity bit: 

= byte granularity, 1 = 4 KBytes (page) granularity. 


22 


+4 


D 


Default length for operands and effective addresses. 

Valid for code and stack segments only: 0=16 bit, 1 = 32-bit. 


20 


+4 


AVL 


Segment available. 


15 


+4 


P 


Segment present. 


14-13 


+4 


DPL 


Descriptor privilege level. 


12 


+4 


DT 


Descriptor type: 

= system, 1 = application. 


11-8 


+4 


TYPE 


Segment type. 

System descriptor (DT = 0): 
0010 = LDT descriptor. 
1001 = TSS descriptor, task not busy. 
1011 = TSS descriptor, task busy. 


11 




E 


Application descriptor (DT = 1): 
= data, 1 = executable. 


10 
9 
8 




C/D 
R/W 
A 


If E = 0: 

= expand up, limit is upper bound of segment. 

1 = expand down, limit is lower bound of segment. 
If E= 1: 

= non-conforming. 

1 = conforming (runs at privilege level of calling procedure). 
If E = 0: 

= non-readable. 

1 = readable. 
If E = l: 

= non-writable. 

1 = writable. 

= not accessed, 1 = accessed. 
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Gate Descriptors provide protection for execut- 
able segments operating at different privilege 
levels. Figure 2-9 illustrates the format for Gate 
Descriptors and Table 2-6 lists the corresponding 
bit definitions. 

Task Gate descriptors are used to switch the CPU's 
context during a task switch. The selector portion 
of the Task Gate descriptor locates a Task State 
Segment. Task Gate descriptors can be located in 
the GDT, LDT or IDT. 



Interrupt Gate descriptors are used to enter a 
hardware interrupt service routine. Trap Gate 
descriptors are used to enter exceptions or software 
interrupt service routines. Trap Gate and Interrupt 
Gate descriptors can only be located in the IDT. 

Call Gate descriptors are used to enter a procedure 
(subroutine) that executes at the same or a more 
privileged level. A Call Gate descriptor primarily 
defines the procedure entry point and the 
procedure's privilege level. 
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Figure 2-9. Gate Descriptor 
Table 2-6. Gate Descriptor Bit Definitions 



BIT 
POSITION 


MEMORY 
OFFSET 


NAME 


DESCRIPTION 


31-16 


+4 


OFFSET 


Offset used during a call gate to calculate the branch target. 


15-0 


+0 






31-16 


+0 


SELECTOR 


Segment selector used during a call gate to calculate the branch target. 


15 


+4 


P 


Segment present. 


14-13 


+4 


DPL 


Descriptor privilege level. 


11-8 


+4 


TYPE 


Segment type: 
0100= 16-bit call gate 
0101 = tack gate 
0110= 1 6-bit interrupt gate 
0111 = 16-bit trap gate 
1100 = 32-bit call gate 

1110 = 32-bit interrupt gate 

1111 = 32-bit trap gate. 


4-0 


+4 


Parameters 


Number of 32-bit parameters to copy from the caller's stack to the called 
procedure's stack. 
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2.3*2.3 Task Register 

The Task Register (TR) holds a 16-bit selector 
for the current Task State Segment (TSS) table 
as shown in Figure 2-10. The TR is loaded and 
stored via the LTR and STR instructions, respec- 
tively. The TR can only be accessed during 
protected mode and can only be loaded when the 
privilege level is (most privileged). When the 
TR is loaded, the TR selector field indexes a TSS 
descriptor that must reside in the global descriptor 



table (GDT). The contents of the selected descrip- 
tor are cached on-chip in the hidden portion of 
the TR. 

During task switching, the processor saves the 
current CPU state in the TSS before starting a new 
task. The TR points to the current TSS. The TSS 
can be either a 286-type 16-bit TSS or a 386/486- 
type 32-bit TSS as shown in Figures 2-11 and 
2-12. An I/O permission bit map is referenced in 
the 32-bit TSS by the I/O Map Base Address. 
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Figure 2- 1 0. Task Register 
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Figure 2-11. 32-Bit Task State Segment (TSS) Table 
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Figure 2-12. 1 6-Bit Task State Segment (TSS) Table 
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2.3.2.4 Configuration Registers 

The Cx486SLC/e contains six registers that do not 
exist on other x86 microprocessors. These 
registers include two 8-bit Configuration Control 
Registers (CCRO and CCR1) and four 16-bit 
Address Region Registers (ARR1 through ARR4) 
as listed in Table 2-7. The CCR and ARR registers 
exist in I/O memory space and are selected by a 
"register index" number via I/O port 22h. I/O 
port 23h is used for data transfer. 

Each I/O port 23h data transfer must be preceded 
by an I/O port 22h register selection, otherwise the 
second and later I/O port 23h operations are 
directed off-chip and produce external I/O cycles. 
If the register index number is outside the 
COh - CFh range, external I/O cycles will also 
occur. 

The CCRO register (Figure 2-13, Table 2-8) 
defines the type of cache and determines if the 
64-KByte memory area on 1 -MByte boundaries 
and 640-KByte to 1 -MByte area are cacheable. 
This register also enables certain pins associated 
with cache control and suspend mode. 

The CCR1 register (Figure 2-14, Table 2-9) is used 
to setup internal cache operation and System 
Management Mode (SMM). The ARR registers 
(Figure 2-15, Table 2-10) are used to define the 
location and size of the memory regions associated 
with the internal cache. ARR1-ARR3 define three 
write protected or non-cacheable memory regions 
as designated by CCR1 bits WP1-WP3. ARR4 
defines a SMM memory space or a non-cacheable 
memory region as defined by CCR1 bit SM4. 



Other CCR1 bits enable RPL and SMM pins and 
control SMM memory access. TheSMACbit 
allows access to defined SMM space while not in 
an SMI service routine. The MMAC bit allows 
access to main memory that overlaps with SMM 
memory while in an SMI service routine for data 
accesses only. 

The ARR registers define address regions using a 
starting address and a block size. The non-cache- 
able region block sizes range from 4 KBytes to 
4 GByte (Table 2-10). A block size of zero 
disables the address region. The starting address 
of the address region must be on a block size 
boundary. For example, a 128 KByte block is 
allowed to have a starting address of KBytes, 
128 KBytes, 256 KBytes, etc. The SMM 
memory region size is restricted to a maximum of 
16 MBytes. The SMM block size must be defined 
for SMI# to be recognized. 



Table 2-7. Configuration Control 
Registers 



REGISTER NAME 


REGISTER 
INDEX 


WIDTH 


Configuration Control 
CCRO 


COh 


8 


Configuration Control 1 
CCR1 


Clh 


8 


Address Region 1 
ARR1 


C5h, C6h 


16 


Address Region 2 
ARR2 


C8h, C9h 


16 


Address Region 3 
ARR3 


CBh, CCh 


16 


Address Region 4 
ARR4 


CEh, CFh 


16 



Note: The following register index numbers are reserved for future 
use: C2h, C3h, C4h, C7h, CAh, CDh and DOh through FFh. 
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Figure 2- H3. Configuration Confrrofl Register © (CCRO) 



Table 2-8. CCRO Bit definitions 



BIT 
POSITION 


NAME 


DESCRIPTION 





NCO 


Non-cacheable 1 -MByte Boundaries 

If=l: Sets the first 64 KBytes at each 1 -MByte boundary as 

non-cacheable . 


1 


NCI 


Non-cacheable Upper Memory Area 

lf=l: Sets 640-KByte to 1 -Mbyte memory region non-cacheable. 


2 


A20M 


Enable A20M# Pin 

If=l: Enables A20M# input pin; otherwise pin is ignored. 


3 


KEN 


Enable KEN# Pin 

If=l: Enables KEN# input pin; otherwise pin is ignored. 


4 


FLUSH 


Enable FLUSH# Pin 

If=l: Enables FLUSH# input pin; otherwise pin is ignored. 


5 


BARB 


Enable Cache Flush during Hold 

If=l: Enables flushing of internal cache when hold state is entered. 


6 


CO 


Cache Type Select 

If=l: Selects direct-mapped cache. 

If =0: Selects 2-way set associative cache. 


7 


SUS 


Enable Suspend Pins 

If=l: Enables SUSP# input pin and SUSPA# output pin. 
If=0: SUSPA# output pin floats, SUSP# input pin is ignored. 
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Figure 2-14. Configuration Control Register 1 (CCR1) 



Table 2-9. CCR1 Bit Definitions 



BIT 
POSITION 


NAME 


DESCRIPTION 


o 


RPL 


FnsKIp PPT Pine 

If=l: RPLSET and RPLVAL# output pins are enabled. 
If=0: RPLSET and RPLVAL# pins float. 


1 


SMI 


Enable SMM Pins. 

If=l: SMI# input/output pin and SMADS# output pin are enabled. 
If=0: SMI# input pin ignored and SMADS# output pin floats. 


2 


SMAC 


System Management Memory Access. 

lf=l: Any access to addresses within the SMM memory space cause external bus cycles 
to be issued with SMADS# output active. SMI# input is ignored. 
If=0: No effect on access. 


3 


MMAC 


Main Memory Access. 

If=l: All data accesses which occur within an SMI service routine (or when SMAC=1) 
will access main memory instead of SMM memory space. 
If=0: No effect on access. 


4 


WP1 


Address Region 1 Control. 

If=l: Region 1 is write protected and cacheable. 

If=0: Region 1 is non-cacheable. 


5 . 


WP2 


Address Region 2 Control. 

If=l: Region 2 is write protected and cacheable. 

If=0: Region 2 is non-cacheable. 


6 


WP3 


Address Region 3 Control. 

If=l: Region 3 is write protected and cacheable. 

If=0: Region 3 is non-cacheable. 


7 


SM4 


Address Region 4 Control. 

If=l: Region 4 is non-cacheable SMM memory space. 
If=0: Region 4 is non-cacheable, SMI# input ignored. 
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Figure 2-1 5. Address Region Registers (ARR1 - ARR4) 
Table 2-10. ARR1 - ARR4 SIZE Field 



BITS 3-0 


BLOCK SIZE 


Oh 


Disabled 


lh 


4 KBytes 


2h 


8 KBytes 


3h 


16 KBytes 


4h 


32 KBytes 


5h 


64 KBytes 


6h 


128 KBytes 


7h 


256 KBytes 



BITS 3-0 


BLOCK SIZE 


8h 


512 KBytes 


9h 


1 MBytes 


Ah 


2 MBytes 


Bh 


4 MBytes 


Ch 


8 MBytes 


Dh 


16 MBytes 


Eh 


32 MBytes 


Fh 


4 GBytes 
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2.3.2.5 Debug Registers 

Six debug registers (DR0-DR3, DR6 and DR7), 
shown in Figure 2-16, support debugging on the 
Cx486SLC/e. Memory addresses loaded in the 
debug registers, referred to as "breakpoints", 
generate a debug exception when a memory access 
of the specified type occurs to the specified address. 
A breakpoint can be specified for a particular kind of 



memory access such as a read or a write. Code and 
data breakpoints can also be set allowing debug 
exceptions to occur whenever a given data access 
(read or write) or code access (execute) occurs. 
The size of the debug target can be set to 1, 2, or 
4 bytes. The debug registers are accessed via MOV 
instructions which can be executed only at privilege 
level 0. 
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Figure 2- 1 6. Debug Registers 
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The debug address registers DR0-DR3 each 
contain the linear address for one of four possible 
breakpoints. Each breakpoint is further specified 
by bits in the debug control register (DR7). For 
each breakpoint address in DR0-DR3, there are 
corresponding fields L, R/W, and LEN in DR7 that 
specify the type of memory access associated with 
the breakpoint. 

The R/W field can be used to specify instruction 
execution as well as data access breakpoints. 
Instruction execution breakpoints are always taken 



before execution of the instruction that matches 
the breakpoint. 

The debug status register (DR6) reflects conditions 
that were in effect at the time the debug exception 
occurred. The contents of the DR6 register are not 
automatically cleared by the processor after a 
debug exception occurs and, therefore, should be 
cleared by software at the appropriate time. 
Table 2-11 lists the field definitions for the DR6 
and DR7 registers. 



Table 2-H U . ®R<6 and ©R7 FieBd Definitions 



REGISTER 


FIELD 


NUMBER OF BITS 


DESCRIPTION 


DR6 


Bi 


1 


Bi is set by the processor if the conditions described by DRi, 
R/Wi, and LENi occurred when the debug exception occurred, 
even if the breakpoint is not enabled via the Gi or Li bits. 




BT 


1 


BT is set by the processor before entering the debug handler if a 
task switch has occurred to a task with the T bit in the TSS set. 




BS 


1 


BS is set by the processor if the debug exception was triggered 
by the single-step execution mode (TF flag in EFLAGS set): 


DR7 


R/Wi 


2 


Applies to the DRi breakpoint address register: 

00 - Break on instruction execution only 

01 - Break on data writes only 

10 - Not used 

11 - Break on data reads or writes. 




LENi 


2 


Applies to the DRi breakpoint address register: 

00 - One byte length 

01 - Two byte length 

10 - Not used 

1 1 - Four byte length. 




Gi 


1 


If set to a 1, breakpoint in DRi is globally enabled for all tasks 
and is not cleared by the processor as the result of a task switch. 




Li 


1 


If set to a 1, breakpoint in DRi is locally enabled for the current 
task and is cleared by the processor as the result of a task switch. 




GD 


1 


Global disable of debug register access. GD bit is cleared 
whenever a debug exception occurs. 
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Code execution breakpoints may also be generated 
by placing the breakpoint instruction (INT 3) at 
the location where control is to be regained. The 
single-step feature may be enabled by setting the 
TF flag in the EFLAGS register. This causes the 
processor to perform a debug exception after the 
execution of every instruction. 

2.3.2.6 Test Registers 

The five test registers, shown in Figure 2-17, are 
used in testing the CPU's translation look-aside 
buffer (TLB) and on-chip cache. TR6 and TR7 are 
used for TLB testing, and TR3-TR5 are used for 
cache testing. Tables 2-12 and 2-13 list the bit 
definitions for the TR6 and TR7 registers. 

TLB Test Registers 

The Cx486SLC/e TLB is a four-way set associative 
memory with eight entries per set. Each TLB 
entry consists of a 24-bit tag and 20-bit data. The 



24-bit tag represents the high-order 20 bits of the 
linear address, a valid bit, and three attribute bits. 
The 20-bit data portion represents the upper 20 
bits of the physical address that corresponds to the 
linear address. 

The TLB Test Control Register (TR6) contains a 
command bit, the upper 20 bits of a linear address, 
a valid bit and the attribute bits used in the test 
operation. The contents of TR6 is used to create 
the 24-bit TLB tag during both write and read 
(TLB lookup) test operations. The command bit 
defines whether the test operation is a read or a 
write. 

The TLB Test Data Register (TR7) contains the 
upper 20 bits of the physical address (TLB data 
field), two LRU bits and a control bit. During TLB 
write operations, the physical address in TR7 is 
written into the TLB entry selected by the contents 
of TR6. During TLB lookup operations, the TLB data 
selected by the contents of TR6 is loaded into TR7. 
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Figure 2- 1 7. Test Registers 
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Table 2-12. TR6 and TR7 Bit Definitions 



REGISTER 
NAME 


BIT 
POSITION 


DESCRIPTION 


TR6 


31-12 


Linear address. 

TLB lookup: The TLB is interrogated per this address. If one and only one match 
occurs in the TLB, the rest of the fields in TR6 and TR7 are updated per the matching 
TLB entry. 

TLB write: A TLB entry is allocated to this linear address. 




11 


Valid bit (V). 

TLB write: If set, indicates that the TLB entry contains valid data. If clear, target 
entry is invalidated. 




10-9 


Dirty attribute bit and its complement (D, D#). (Refer to Table 2-13). 




8-7 


User/supervisor attribute bit and its complement (U, U#). (Refer to Table 2-13). 




6-5 


Read/write attribute bit and its complement (R, R#). (Refer to Table 2-13). 







Command bit (C). 
If = 0: TLB write. 
If = 1: TLB lookup. 


TR7 


31-12 


Physical address. 

TLB lookup: data held Irom the TLB. 
TLB write: data field written into the TLB. 




11 


Page-level cache disable bit (PCD). 
Corresponds to the PCD bit of a page table entry. 




10 


Page-level cache write-through bit (PWT). 
Corresponds to the PWT bit of a page table entry. 




9-7 


LRU bits. 

TLB lookup: LRU bits associated with the TLB entry prior to the TLB lookup. 
TLB write: ignored. 




4 


PL bit. 

TLB lookup: If = 1 , read hit occurred. If = 0, read miss occurred. 

TLB write: If = 1, REP field is used to select the set. If = 0, the pseudo-LRU 

replacement algorithm is used to select the set. 




3-2 


Set selection (REP). 

TLB lookup: If PL = 1, set in which the tag was found. If PL = 0, undefined data. 
TLB write: If PL = 1 , selects one of the four sets for replacement. If PL=0, ignored. 
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Table 2-13. TR6 Attribute Bit Pairs 



BIT 

(B) 


BIT COMPLEMENT 

CB#) 


EFFECT ON TLB LOOKUP 


EFFECT ON TLB WRITE 








Do not match. 


Undefined. 





1 


Match if the bit isO. 


Clear the bit. 


1 





Match if the bit is 1 . 


Set the bit. 


1 


1 


Match if the bit is 1 or 0. 


Undefined. 



Cache Test Registers 

The Cx486SLC/e 1 -KByte on-chip cache can be 
configured either as a direct-mapped (256 entries) 
or as a two-way set associative memory (128 
entries per set). Each entry consists of a 23-bit 
tag, a 32-bit data field, four valid bits and an LRU 
bit. The 23-bit tag represents the high-order 23 
bits of the physical address. The 32-bit data 
represents the four bytes of data currently in 
memory at the physical address represented by the 
tag. The four valid bits indicate which of the four 
data bytes actually contain valid data. The LRU bit 
is only accessed when the cache is configured as 
two-way set associative and indicates which of the 
two sets was most recently accessed. 

The Cx486SLC/e contains three test registers that 
allow testing of its internal cache. Using these 
registers, cache test writes and reads may be 
performed. Cache test writes cause the data in 
TR3 to be written to the selected set and entry in 
the cache. Cache test reads allow inspection of-the 
data, valid bits and the LRU bit for the cache 
entry. For data to be written to the allocated 
entry, the valid bits for the entry must be set prior 
to the write of the data. Bit definitions for the 
cache test registers are shown in Table 2-14. 
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Table 2-14. TR3-TR5 Bit Definitions 



REGISTER 

NAME 


BIT 
POSITION 


DESCRIPTION 


TR3 


31-10 


Cache data. 

Cache read: data accessed from the cache. 
Cache write: data to be written into the cache. 


TR4 


31-9 


Tag address. 

Cache read: tag address from which data is read. 

Cache write: data written into the tag address of the selected entry. 




7 


LRU Bit. (Used with two-way configuration only) 
Cache read: the LRU bit associated with the cache entry. 
Cache write: ignored. 




6-3 


Valid Bits 

Cache read: valid bits for. the accessed entry, (one bit per byte). 
Cache write: valid bits written into the entry. 


TR5 


10-4 


Entry Selection 

Two-Way Configuration: 

Address bits 8-2 for selecting one of 128 entries. 

Direct-Mapped Configuration: 
Address bits 8-2 for selecting one of 256 entries. 
Cache read: TR5-bit 2 is address bit 9. 
Cache write: TR4-bit 9 is address bit 9. 




2 


Two-Way Configuration: 
Set selection. 
If = 0: set is selected. 
If = 1: set 1 is selected. 

Direct-Mapped Configuration: 

Cache read: Address bit 9 for selecting of one of 256 lines. 




1-0 


Control bits. These bits control reading or writing the cache. 
If =00: Ignored. 
If = 01: Cache write. 
If = 10: Cache read. 

If = 11: Cache flush (marks all entries as invalid). 
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Address Spaces 



2.4 



Address Spaces 



The Cx486SLC/e can directly address either 
memory or I/O space. Figure 2-18 illustrates the 
range of addresses available for memory address 
space and I/O address space. For the Cx486SLC/e, 
the addresses for physical memory range between 
00 OOOOh and FF FFFFh (16 MBytes).. The 
accessible I/O addresses space ranges between 



00 OOOOh and 00 FFFFh (64 KBytes). The copro- 
cessor communication space exists in upper I/O 
space between 80 00F8h and 80 OOFFh. These 
coprocessor I/O ports are automatically accessed 
by the CPU whenever an ESC opcode is executed. 
The I/O locations 22h and 23h are used for 
Cx486SLC/e configuration register access. 
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I/O Space 
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Register I/O 
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■ 00 0023h 

. 00 0022h 



Figure 2- 1 8. Memory and I/O Address Spaces 
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2.4. 1 I/O Address Space 

The Cx486SLC/e I/O address space is accessed 
using IN and OUT instructions to addresses 
referred to as "ports". The accessible I/O address 
space is 64 KBytes and can be accessed as 8-bit, 
16-bit or 32-bit ports. The execution of any IN or 
OUT instruction causes the M/IO# pin to be 
driven low, thereby selecting the I/O space instead 
of memory space for loading or storing data. The 
upper 8 address bits are always driven low during 
IN and OUT instruction port accesses. 

The Cx486SLC/e configuration registers reside 
within the I/O address space at port addresses 22h 
and 23h and are accessed using the standard IN 
and OUT instructions. The configuration registers 
are modified by writing the index of the configura- 
tion register to port 22h and then transferring the 
data through port 23h. Accesses to the on-chip 
configuration registers do not generate external 
I/O cycles. However, each port 23h operation 
must be preceded by a port 22h write with a valid 
index value. Otherwise, the second and later port 
23h operations are directed off-chip and generate 
external I/O cycles without modifying the on-chip 
configuration registers. Also, writes to port 22h 
outside of the Cx486SLC/e index range (COh to 
CFh) result in external I/O cycles and do not effect 
the on-chip configuration registers. Reads of port 
22h are always directed off-chip. 

2.4.2 Memory Address Space 

The Cx486SLC/e directly addresses up to 16 
MBytes of physical memory. Memory address 
space is accessed as bytes, words (16-bits) or 
doublewords (32-bits). Words and doublewords 



are stored in consecutive memory bytes with the 
low-order byte located in the lowest address. The 
physical address of a word or doubleword is the 
byte address of the low-order byte. 

With the Cx486SLC/e, memory can be addressed 
using nine different addressing modes. These 
addressing modes are used to calculate an offset 
address often referred to as an effective address. 
Depending on the operating mode of the CPU, the 
offset is then combined using memory manage- 
ment mechanisms to create a physical address that 
actually addresses the physical memory devices. 

Memory management mechanisms on the 
Cx486SLC/e consist of segmentation and paging. 
Segmentation allows each program to use several 
independent, protected address spaces. Paging 
supports a memory subsystem that simulates a 
large address space using a small amount of RAM 
and disk storage for physical memory. Either or 
both of these mechanisms can be used for manage- 
ment of the Cx486SLC/e memory address space. 

2.4.2.1 Offset Mechanism 

The offset mechanism computes an offset (effec- 
tive) address by adding together up to three 
values: a base, an index and a displacement. The 
base, if present, is the value in one of eight 32-bit 
general registers at the time of the execution of 
the instruction. The index, like the base, is a value 
that is contained in one of the 32-bit general 
registers (except the ESP register) when the 
instruction is executed. The index differs from the 
base in that the index is first multiplied by a scale 
factor of 1, 2, 4 or 8 before the summation is 
made. The third component added to the 
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memory address calculation is the displacement 
which is a value of up to 32-bits in length supplied 
as part of the instruction. Figure 2-19 illustrates 
the calculation of the offset address. 

Nine valid combinations of the base, index, scale 
factor and displacement can be used with the 
Cx486SLC/e instruction set. These combinations 
are listed in Table 2-15. The base and index both 
refer to contents of a register as indicated by [Base] 
and [Index]. 



Index 



Base 



Displacement 



Scaling 
xl, x2, x4, x8 



► Offset Address 
(Effective Address) 



Figure 2-19. Offset Address Calculation 



Table 2- 1 5* Memory Addressing Modes 



ADDRESSING 
MODE 


BASE 


INDEX 


SCALE 
FACTOR 
CSF) 


DISPLACEMENT 
(DP) 


OFFSET ADDRESS (OA) 
CALCULATION 


Direct 








X 


OA = DP 


Register Indirect 


x 








OA = [BASE] 


Based 


X 






X 


OA = [BASE] + DP 


Index 




X 




X 


OA = [INDEX] + DP 


Scaled Index 




X , 


X 


X 


OA = ([INDEX] * SF) + DP 


Based Index 


X 


X 






OA = [BASE] + [INDEX] 


Based Scaled 


X 


X 


X 




OA = [BASE] + ([INDEX] * SF) 


Index 












Based Index with 


X 


X 




X 


OA = [BASE] + [INDEX] + DP 


Displacement 












Based Scaled 


X 


X 


X 


X 


OA = [BASE] + ([INDEX] * SF) + DP 


Index with 












Displacement 
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2.4.2.2 Real Mode Memory 
Addressing 

In real mode operation, the Cx486SLC/e only 
addresses the lowest 1 MByte (2 20 ) of memory. 
To calculate a physical memory address, the 
16-bit segment base address located in the selected 
segment register is multiplied by 16 and then the 
16-bit offset address is added. The resulting 20-bit 
address is then extended with four zeros in the 
upper address bits to create the 24-bit physical 
address. Figure 2-20 illustrates the real mode 
address calculation. Physical addresses beyond 
1 MByte cause a segment limit overrun 
exception. 

The addition of the base address and the offset 
address may result in a carry. Therefore, the 
resulting address may actually contain up to 21 
significant address bits that can address memory in 
the first 64 KBytes above 1 MByte. 



2.4.2.3 Protected Mode Memory 
Addressing 

In protected mode three mechanisms calculate a 
physical memory address (Figure 2-21). 

© Offset Mechanism that produces the offset 
or effective address as in real mode. 

© Selector Mechanism that produces the base 
address. 

© Optional Paging Mechanism that translates a 
linear address to the physical memory address. 

The offset and base address are added together to 
produce the linear address. If paging is not used, 
the linear address is used as the physical memory 
address. If paging is enabled, the paging mecha- 
nism is used to translate the linear address into the 
physical address. The offset mechanism is de- 
scribed earlier in this section and applies to both 
real and protected mode. The selector and paging 
mechanisms are described in the following para- 
graphs. 



Offset Mechanism 



Offset Addresss 



Linear Address = Physical Address 



Selected Segment 




X 16 




Register 







Figure 2-20. Real Mode Address Calculation 
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Base Address 
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Physical 
Memory 
Address 



Figure 2-2 1 . Protected Mode Address Calculation 



Selector Mechanism 

Memory is divided into an arbitrary number of 
segments, each containing usually much less than 
the 2 32 byte (4 GByte) maximum. 

The six segment registers (CS, DS, SS, ES, FS and 
GS) each contain a 16-bit selector that is used 
when the register is loaded to locate a segment 
descriptor in either the global descriptor table 
(GDT) or the local descriptor table (LDT). The 
segment descriptor defines the base address, limit 



and attributes of the selected segment and is cached on 
the Cx486SLC7e as a result of loading the selector. 
The cached descriptor contents are not visible to 
the programmer. When a memory reference 
occurs in protected mode, the linear address is 
generated by adding the segment base address in 
the hidden portion of the segment register to the 
offset address. If paging is not enabled, this linear 
address is used as the physical memory address. 
Figure 2-22 illustrates the operation of the selector 
mechanism. 
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Paging Mechanism 

The paging mechanism supports a memory 
subsystem that simulates a large address space 
with a small amount of RAM and disk storage. 
The paging mechanism either translates a linear 
address to its corresponding physical address or 
generates an exception if the required page is not 
currently present in RAM. When the operating 
system services the exception, the required page is 
loaded into memory and the instruction is then 
restarted. Pages are either 4 KBytes or 1, MByte in 
size. The CPU defaults to 4-KByte pages that are 
aligned to 4 KByte boundaries. 

A page is addressed by using two levels of tables as 
illustrated in Figure 2-23. The upper 10 bits of 
the 32-bit linear address are used to locate an entry 
in the page directory table. The page directory 
table acts as a 32-bit master index to up to IK 
individual second-level page tables. The selected 
entry in the page directory table, referred to as the 
directory table entry, identifies the starting address 
of the second-level page table. The page direc- 
tory table itself is a page and is, therefore, aligned 
to a 4 KByte boundary. The physical address of 
the current page directory is stored in the CR3 
control register, also referred to as the Page 
Directory Base Register (PDBR). 

Bits 12-21 of the 32-bit linear address, referred to 
as the Page Table Index, locate a 32-bit entry in 



the second-level page table. This Page Table 
Entry (PTE) contains the base address of the 
desired page frame. The second-level page table 
addresses up to IK individual page frames. A 
second-level page table is 4 KBytes in size and is 
itself a page. The lower 12 bits of the 32-bit linear 
address, referred to as the Page Frame Offset 
(PFO), locate the desired data within the page 
frame. 

Since the page directory table can point to IK 
page tables, and each page table can point to IK of 
page frames, a total of 1M of page frames can be 
implemented. Since each page frame contains 
4 KBytes, up to 4 GBytes of virtual memory can 
be addressed by the Cx486SLC/e with a single 
page directory table. 

In addition to the base address of the page table or 
the page frame, each Directory Table Entry or 
Page Table Entry contains attribute bits and a 
present bit as illustrated in Figure 2-24 and listed 
in Table 2-16. 

If the present bit (P) is set in the DTE, the page 
table is present and the appropriate page table 
entry is read. If P=l in the corresponding PTE 
(indicating that the page is in memory), the 
accessed and dirty bits are updated, if necessary, 
and the operand is fetched. Both accessed bits are 
set (DTE and PTE), if necessary, to rndicate that 
the table and the page have been used to translate 
a linear address. The dirty bit (D) is set before the 
first write is made to a page. 
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Figure 2-23. Paging Mechanism 
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The present bits must be set to validate the 
remaining bits in the DTE and PTE. If either of 
the present bits are not set, a page fault is gener- 
ated when the DTE or PTE is accessed. If P=0, 
the remaining DTE/PTE bits are available for use 
by the operating system. For example, the 
operating system can use these bits to record 
where on the hard disk the pages are located. A 
page fault is also generated if the memory refer- 
ence violates the page protection attributes. 



Translation Look-Aside Buffer 

The translation look-aside buffer (TLB) is a cache 
for the paging mechanism and replaces the two- 
level page table lookup procedure for cache hits. 
The TLB is a four-way set associative 32-bit entry 
page table cache that automatically keeps the 
most commonly used page table entries in the 
processor. The 32-bit entry TLB, coupled with a 
4K page size, results in coverage of 128 KBytes of 
memory addresses. 



Table 2- H 6. Pirecfoiry and Page TabBe Enihry {IDTTE and PTE) Biifl B>eflnm3&5ons 



BIT POSITION 


FIELD NAME 


DESCRIPTION 


31 - 12 


BASE 
ADDRESS 


Specifies the base address of the page or page table. 


11-9 




Undefined and available to the programmer. 


8-7 




Reserved and not available to the programmer. 


6 


D 


Dirty Bit. If set, indicates that a write access has occurred to the 
page (PTE only, undefined in DTE). 


5 


A 


Accessed Flag. If set, indicates that a read access or write access has 
occurred to the page. 


4 


PCD 


Page Caching Disable Flag. If set, indicates that the page is not 
cacheable in the on-chip cache. 


3 




Reserved and not available to the programmer. 


2 


u/s 


User/Supervisor Attribute. If set (user), page is accessible at all 
privilege levels. < 2 If clear (supervisor), page is accessible only 
whenCPL<2. 


1 


W/R 


Write/Read Attribute. If set (write), page is writable. If clear (read), 
page is read only. 





P 


Present Flag. If set, indicates that the page is present in RAM 
memory, and validates the remaining DTE/PTE bits. If clear, 
indicates that the page is not present in memory and the remaining 
DTE/PTE bits can be used by the programmer. 
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The TLB must be flushed when entries in the page 
tables are changed. The TLB is flushed whenever 
the CR3 register is loaded. An individual entry in 
the TLB can be flushed using the INVLPG instruc- 
tion. 

2.5 Interrupts and 
Exceptions 

The processing of either an interrupt or an excep- 
tion changes the normal sequential flow of a 
program by transferring program control to a 
selected service routine. Except for SMM inter- 
rupts, the location of the selected service routine 
is determined by one of the interrupt vectors 
stored in the interrupt descriptor table. 

All true interrupts are hardware interrupts and are 
generated by signal sources external to the CPU. 
All exceptions (including so-called software 
interrupts) are produced internally by the CPU. 



2.5.2 Interrupts 

External events can interrupt normal program 
execution by using one of the three interrupt pins 
on the Cx486SLC/e. 

• Non-maskable Interrupt (NMI pin) 

• Maskable Interrupt (INTR pin) 

• SMM Interrupt (SMI# pin) 

For most interrupts, program transfer to the 
interrupt routine occurs after the current instruc- 
tion has been completed. When the execution 
returns to the original program, it begins immedi- 
ately following the interrupted instruction. 



The NMI interrupt cannot be masked by soft- 
ware and always uses interrupt vector 2 to locate 
its service routine. Since the interrupt vector is 
fixed and is supplied internally, no interrupt 
acknowledge bus cycles are performed. This 
interrupt is normally reserved for unusual situa- 
tions such as parity errors and has priority over 
INTR interrupts. 

Once NMI processing has started, no additional 
NMIs are processed until an IRET instruction is 
executed, typically at the end of the NMI service 
routine. If NMI is re-asserted prior to execution of 
the IRET instruction, one and only one NMI rising 
edge is stored and then processed after execution 
of the next IRET. 

During the NMI service routine maskable inter- 
rupts are still enabled. If an unmasked INTR 
occurs during the NMI service routine, the INTR 
is serviced and execution returns to the NMI 
service routine following the next IRET. If a 
HALT instruction is executed within the NMI 
service routine, the Cx486SLC/e restarts execution 
only in response to RESET, an unmasked INTR or 
an SMM interrupt. NMI does not restart CPU 
execution under this condition. 

The INTR interrupt is unmasked when the 
Interrupt Enable Flag (IF) in the EFLAGS register 
is set to 1. With the exception of string opera- 
tions, INTR interrupts are acknowledged between 
instructions. Long string operations have interrupt 
windows between memory moves that allow 
INTR interrupts to be acknowledged. 

When an INTR interrupt occurs, the CPU per- 
forms two locked interrupt acknowledge bus 
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cycles. During the second cycle, the CPU reads an 
8-bit vector which is supplied by an external 
interrupt controller. This vector selects which of 
the 256 possible interrupt handlers will be ex- 
ecuted in response to the interrupt. 

The SMM interrupt has higher priority than 
either 1NTR or NM1. After SMI# is asserted, 
program execution is passed to an SMI service 
routine which runs in SMM address space reserved 
for this purpose. The remainder of this section 
does not apply to the SMM interrupts. SMM 
interrupts are described in greater detail later in 
this chapter. 

X5.2 Exceptions 

Exceptions are generated by an interrupt instruc- 
tion or a program error. Exceptions are classified 
as traps, faults or aborts depending on the mecha- 
nism used to report them and the restartablity of 
the instruction which first caused the exception. 

A trap exception is reported immediately follow- 
ing the instruction that generated the trap excep- 
tion. Trap exceptions are generated by execution 
of a software interrupt instruction during single 
stepping, at a breakpoint or by software interrupt 
instruction (INTO, INT 3, INT n, BOUND), by a 
single-step operation or by a data breakpoint. 

Software interrupts can be used to simulate hard- 
ware interrupts. For example, an INT n instruc- 
tion causes the processor to execute the interrupt 
service routine pointed to by the nth vector in the 
interrupt table. Execution of the interrupt service 
routine occurs regardless of the state of the IF flag 
in the EFLAGS register. 



The one byte INT 3, or breakpoint interrupt 
(vector 3), is a particular case of the INT n instruc- 
tion. By inserting this one byte instruction in a 
program, the user can set breakpoints in the code 
that can be used during debug. 

Single-step operation is enabled by setting the TF 
bit in the EFLAGS register. When TF is set, the 
CPU generates a debug exception (vector 1) after 
• the execution of every instruction. Data break- 
points also generate a debug exception and are 
specified by loading the debug registers (DRO- 
DR7) with the appropriate values. 

A fault exception is caused by a program error 
and is reported prior to completion of the instruc- 
tion that generated the exception. By reporting . 
the fault prior to instruction completion, the CPU 
is left in a state which allows the instruction to be 
restarted and the effects of the faulting instruction 
to be nullified. Fault exceptions include divide-by- 
zero errors, invalid opcodes, page faults and 
coprocessor errors. Debug exceptions (vector 1) 
are also handled as faults (except for data break- 
points and single-step operations). After execu- 
tion of the fault service routine, the instruction 
pointer points to the instruction that caused the 
fault. 

An abort exception is a type of fault exception 
that is severe enough that the CPU cannot restart 
the program at the faulting instruction. Abort 
exceptions include the double fault (vector 8) and 
coprocessor segment overrun (vector 9). 
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2.5.3 Interrupt Vectors 

When the CPU services an interrupt or exception, 
the current program's instruction pointer and flags 
are pushed onto the stack to allow resumption of 
execution of the interrupted program. In pro- 
tected mode, the processor also saves an error code 
for some exceptions. Program control is then 
transferred to the interrupt handler (also called the 
interrupt service routine). Upon execution of an 
IRET at the end of the service routine, program 



execution resumes at the instruction pointer 
address saved on the stack when the interrupt was 
serviced. 

Interrupt Vector Assignments 

Each interrupt (except SMI#) and exception is 
assigned one of 256 interrupt vector numbers 
(Table 2-17). The first 32 interrupt vector assign- 
ments are defined or reserved. INT instructions 
acting as software interrupts may use any of 
interrupt vectors, through 255. 



Table 2- 1 7. Interrupt Vector Assignments 



INTERRUPT VECTOR 


FUNCTION 


EXCEPTION TYPE 





Divide error 


FAULT 


1 


Debug exception 


TRAP/FAULT 


2 


NMI interrupt 




3 


Breakpoint 


TRAP 


4 


Interrupt on overflow 


TRAP 


5 


BOUND range exceeded 


FAULT 


6 


Invalid opcode 


FAULT 


7 


Device not available 


FAULT 


8 


Double fault 


ABORT 


9 


Coprocessor segment overrun 


ABORT 


10 


Invalid TSS 


FAULT 


11 


Segment not present 


FAULT 


12 


Stack fault 


FAULT 


13 


General protection fault 


TRAP/FAULT 


14 


Page fault 


FAULT 


15 


Reserved 




16 


Coprocessor error 


FAULT 


17 


Alignment check exception 


FAULT 


18-31 


Reserved 




32-255 


Maskable hardware interrupts 


TRAP 


0-255 


Programmed interrupt . 


TRAP 
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The non-maskable hardware interrupt (NMI) is 
assigned vector 2. 

In response to a maskable hardware interrupt 
(1NTR), the Cx486SLC/e issues interrupt 
acknowledge bus cycles used to read the vector 
number from external hardware. These vectors 
should be in the range 32-255 as vectors 0-31 
are pre-defined. 

Interrupt Descriptor Table 

The interrupt vector number is used by the 
Cx486SLC/e to locate an entry in the interrupt 
descriptor table (IDT). In real mode, each IDT 
entry consists of a four-byte far pointer to the 
beginning of the corresponding interrupt service 
routine. In protected mode, each IDT entry is an 
eight-byte descriptor. The Interrupt Descriptor 
Table Register (IDTR) specifies the beginning 
address and limit of the IDT Following reset, the 
IDTR contains a base address of Oh with a limit of 
3FFh. 

The IDT can be located anywhere in physical 
memory as determined by the IDTR register. The 
IDT may contain different types of descriptors: 
interrupt gates, trap gates and task gates. Inter- 
rupt gates are used primarily to enter a hardware 
interrupt handler. Trap gates are generally used to 
enter an exception handler or software interrupt 
handler. If an interrupt gate is used, the Interrupt 
Enable Flag (IF) in the EFLAGS register is cleared 
before the interrupt handler is entered. Task gates 
are used to make the transition to a new task. 



2.5.4 Interrupt and Exception 
Priorities 

As the Cx486SLC/e executes instructions, it 
follows a consistent policy for prioritizing excep- 
tions and hardware interrupts. The priorities for 
competing interrupts and exceptions are listed in 
Table 2-18. SMM interrupts always take prece- 
dence. Debug traps for the previous instruction 
and next instructions are handled as the next 
priority. When NMI and maskable INTR inter- 
rupts are both detected at the same instruction 
boundary, the Cx486SLC/e microprocessor 
services the NMI interrupt first. 

The Cx486SLC/e checks for exceptions in parallel 
with instruction decoding and execution. Several 
exceptions can result from a single instruction. 
However, only one exception is generated upon 
each attempt to execute the instruction. Each 
exception service routine should make the 
appropriate corrections to the instruction and 
then restart the instruction. In this way, excep- 
tions can be serviced until the instruction executes 
properly. 

The Cx486SLC/e supports instruction restart after 
all faults, except when an instruction causes a task 
switch to a task whose task state segment (TSS) is 
partially not present. A TSS can be partially not 
present if the TSS is not page aligned and one of 
the pages where the TSS resides is not currently in 
memory. 
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Table 2-18. Interrupt and Exception Priorities 



PRIORITY 


DESCRIPTION 


NOTES 


o 


SMM hardware interrupt. 


(-HVJLIV1 li 1 LCI 1 U. iJ LJ dlC LuUjCU. U V IV 1 LTT COOCI LCH 

and always have highest priority. 


1 


Debug traps and faults from previous 
instruction. 


Includes single-step trap and data breakpoints 
specified in the debug registers. 


2 


Debug traps for next instruction. 


Includes instruction execution breakpoints 
specified in the debug registers. 


3 


Non-maskable hardware interrupt. 


Caused by NMI asserted. 


4 


Maskable hardware interrupt. 


Caused by INTR asserted and IF = 1. 


5 


Faults resulting from fetching the next 
instruction. 


Includes segment not present, general protection 
fault and page fault. 


6 


Faults resulting from instruction decoding. 


Includes illegal opcode, instruction too long, or 
privilege violation. 


7 


WAIT instruction and TS = 1 and MP = 1 . 


Device not available exception generated. 


8 


ESC instruction and EM = 1 or TS = 1 . 


Device not available exception generated. 


9 


Coprocessor error exception. 


Caused by ERROR# asserted. 


10 


Segmentation faults (for each memory 
reference required by the instruction) that 
prevent transferring the entire memory 
operand. 


Includes segment not present, stack fault, and 
general protection fault. 


11 


Page Faults that prevent transferring the 
entire memory operand. 




12 


Alignment check fault. 
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2.5.5 Exceptions in Real Mode 

Many of the exceptions described in Table 2-17 
are not applicable in real mode. Exceptions 10, 
11, and 14 do not occur real mode. Other excep- 
tions have slightly different meanings in real mode 
as listed in Table 2-19. 



Table 2-1 9. Exception Changes in Real! Mode 



VECTOR NUMBER 


PROTECTED MODE FUNCTION 


REAL MODE FUNCTION 


8 


Double fault. 


Interrupt table limit overrun. 


10 


Invalid TSS. 




11 


Segment not present. 




12 _j 


Stack fault. 


SS segment limit overrun. 


13 


General protection fault. 


CS, DS, ES, FS, GS segment limit overrun. 


14 


Page fault. 





Note: — = does not occur 
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2.5.6 Error Codes 

When operating in protected mode, the following 
exceptions generate a 16-bit error code: 

Double Fault 
Alignment Check 
Invalid TSS 
Segment Not Present 
Stack Fault 

General Protection Fault 
Page Fault 

The error code format is shown in Figure 2-25 and 
the error code bit definitions are listed in 
Table 2-20. Bits 15-3 (selector index) are not 
meaningful if the error code was generated as the 
result of a page fault. The error code is always zero 
for double faults and alignment check exceptions. 
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Figure 2-25. Error Code Format 



Table 2-20. Error Code Bit Definitions 



FAULT 
TYPE 


SELECTOR 
INDEX 
(BITS 1 5-3) 


S2 
(BIT 2) 


SI 
(BIT 1) 


SO 
(BIT O) 


Page Fault 


Reserved 


Fault caused by: 

= not present page 

1 = page-level 
protection violation. 


Fault occurred 
during: 

= read access 

1 = write access. 


Fault occurred during: 

= supervisor access 

1 = user access. 


IDT Fault 


Index of faulty 
IDT selector. 


Reserved 


1 


If = 1, exception 
occurred while trying 
to invoke exception or 
hardware interrupt 
handler. 


Segment 
Fault 


Index of faulty 
selector. 


TI bit of faulty 
selector. 





If =1, exception 
occurred while trying 
to invoke exception or 
hardware interrupt 
handler. 
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2.6 System Management 
Mode 

2.6. 1 Introduction 

System Management Mode (SMM) provides an 
additional interrupt which can be used for system 
power management or software transparent 
emulation of I/O peripherals. SMM is entered 
using the System Management Interrupt (SMI#) 
which has a higher priority than any other inter- 
rupt, including NMI. After reception of an SMI#, 



portions of the CPU state are automatically saved, 
SMM is entered and program execution begins at 
the base of SMM address space (Figure 2-26). 
Running in protected SMM address space, the 
interrupt routine does not interfere with the 
operating system or any application program. 

Seven SMM instructions have been added to the 
486SX instruction set. that permit saving and 
restoring of the total CPU state when in SMM 
mode. Two new pins, SMI# and SMADS#, support 
SMM functions. 
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Figure 2-26. System Management Memory Address Space 
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2.6.2 SMM Operation 

SMM operation is summarized in Figure 2-27. 
Entering SMM requires the assertion of the SMI# 
pin for at least four CLK2 periods. For the SMI# 
input to be recognized, the following configuration 
register bits must be set as shown below: 

SMI CCRl(l) =1 

SMAC CCR1 (2) = 

SM4 CCR1 (7) = 1 

ARR4 SIZE (3-0) >0 

The configuration registers are discussed in detail 
earlier in this chapter. After recognizing SMI#, 
and prior to executing the SMI service routine, 
some of the CPU state information is changed. 
Prior to modification, this information is auto- 
matically saved in the SMM memory space header 
located at the top of SMM memory space. After 
the header is saved, the CPU enters real mode and 
begins executing the SMI service routine starting 
at the SMM memory base address. 

The SMI service routine is user definable and may 
contain system or power management software. If 
the power management software forces the CPU 
to power down, or the SMI service routine modi- 
fies more than what is automatically saved, the 
complete CPU state information must be saved. 
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Figure 2-27. SMI Execution 
Flow Diagram 



A complete CPU state save is performed by using 
MOV instructions to save normally accessible 
information, and by using the SMM instructions to 
save CPU information that is not normally acces- 
sible to the programmer. As will be explained, 
SMM instructions (SVDC, SVLDT, and SVTS) are 
used to store the LDTR, TSR, and the segment 
registers and their associated descriptor cache 



entries in 80-bit memory locations. After power 
up or at the end of the SMI service routine, the 
MOV and additional SMM instructions (RSDC, 
RSLDT and RSTS) are used to restore the CPU 
state. The SMM RSM instruction returns the CPU 
to normal execution. 
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2.6.3 SMM Memory Space 
Header 

With every SMI interrupt, certain CPU state 
information is automatically saved in the SMM 
memory space header located at the top of SMM 



address space (Figure 2-28 and Table 2-21). The 
header contains CPU state information that is 
modified when servicing an SMI interrupt. In- 
cluded in this information are two pointers. The 
Current IP points to the instruction executing 
when the SMI was detected. The Next IP points 
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Figure 2-28. SMM Memory Space Header 
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to the instruction that will be executed after 
exiting SMM. Also saved are the contents of 
debug register 7 (DR7), the extended flags register 
(EFLAGS), and control register (CRO). If SMM 
has been entered due to an I/O trap for a REP 



INSx or REP OUTSx instruction, the Current IP 
and Next IP fields (Table 2-21) contain the same 
addresses and the I and P field contain valid 
information. 



Table 2-2 1 • SMM Memory Space Header 



NAME 


DESCRIPTION 


SIZE 


DR7 


The contents of the debug register 7. 


4 Bytes 


EFLAGS 


The contents of the extended flag register. 


4 Bytes 


CRO 


The contents of the control register 0. 


4 Bytes 


Current IP 


The address of the instruction executed prior to servicing the SMI 
interrupt. 


4 Bytes 


Next IP 


The address of the next instruction that will be executed after 
exiting the SMM mode. 


4 Bytes 


CS Selector 


Code segment register selector for the current code segement. 


2 Bytes 


CS Descriptor 


Code segment register descriptor for the current code segement. 


8 Bytes 


P 


REP INSx/OUTSx Indicator 

P=l if current instruction has a REP prefix. 

P=0 if current instruction does not have REP prefix. 


1 Bit 


I 


IN, INSx, OUT, or OUTSx Indicator 

1=1 if current instruction performed is an I/O WRITE. 

1=0 if current instruction performed is an I/O READ. 


1 Bit 


ESI or EDI 


Restored ESI or EDI value. Used when it is necessary to repeat a REP 
OUTSx or REP INSx instruction when one of the I/O cycles caused 
an SMI# trap. 


4 Bytes 



Note: INSx = INS, INSB, INSW or INSD instruction. 

Note: OUTSx = OUTS, OUTSB, OUTSW and OUTSD instruction. 
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2.6.4 SMM Instructions 

The Cx486SLC/e automatically saves the minimal 
amount of CPU state information when entering 
SMM which allows fast SMI service routine entry 
and exit. After entering the SMI service routine, 
the MOV, SVDC, SVLDT and SVTS instructions 
can be used to save the complete CPU state informa- 
tion. If the SMI service routine modifies more 
than what is automatically saved or forces the 
CPU to power down, the complete CPU state 
information must be saved. Since the Cx486SLC/e 
is a static device, its internal state is retained when 
the input clock is stopped. Therefore, an entire 
CPU state save is not necessary prior to stopping 
the input clock. 



The new SMM instructions, listed in Table 2-22, 
can only be executed if: (a) the Current Privilege 
Level (CPL) = and the SMAC bit (CCR1, bit 2) 
is set; or (b) CPL = and the CPU is in an SMI 
service routine (SMI# = 0). If both these condi- 
tions are not met and an attempt is made to 
execute an SVDC, RSDC, SVLDT, RSLDT, SVTS, 
RSTS or RSM instruction, an invalid opcode 
exception is generated. These instructions can be 
executed outside of defined SMM space provided the 
above conditions are met. All of the SMM instruc- 
tions (except RSM) save or restore 80 bits of data 
allowing the saved values to include the hidden 
portion of the register contents. 



Table 2-22 SMM Instruction Set 



INSTRUCTION 


OPCODE 


FORMAT 


DESCRIPTION 


SVDC 


0F78[modsreg3 r/m] 


SVDCmem80,sreg3 


Save Segment Register and Descriptor 

Saves reg (DS, ES, FS, GS, or SS) to mem80. 


RSDC 


OF 79 [modsreg3r/m] 


RSDCsreg3,mem80 


Restore Segment Register and Descriptor 

Restores reg (DS, ES, FS, GS, or SS) from mem80. 

(CS is automatically restored with RSM.) 


SVLDT 


OF 7 A [mod 000 r/m] 


SVLDT mem80 


Save LDTR and Descriptor 

Saves Local Descriptor Table (LDTR) to mem80. 


RSLDT 


OF 7B [mod 000 r/m] 


RSLDT mem80 


Restore LDTR and Descriptor 

Restores Local Descriptor Table (LDTR) from mem80. 


SVTS 


OF 7C [mod 000 r/m] 


SVTS mem80 


Save TSR and Descriptor 

Saves Task State Register (TSR) to mem80. 


RSTS 


OF 7D [mod 000 r/m] 


RSTS mem80 


Restore TSR and Descriptor 

Restores Task State Register (TSR) from mem80. 


RSM 


OF AA 


RSM 


Resume Normal Mode 

Exits SMM mode. The CPU state is restored using the 
SMM memory space header and execution resumes at 
interrupted point. 



Note: mem80 = 80-bit memory location. 
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2.6.5 SMM Memory Space 

SMM memory space is defined by assigning 
Address Region 4 to SMM memory space. This 
assignment is made by setting bit 7 (SM4) in the 
on-chip CCR1 register. ARR4, also an on-chip 
configuration register, specifies the base address 
and size of the SMM memory space. The base 
address must be a multiple of the SMM memory 
space size. For example, a 32 KByte SMM 
memory space must be located at a 32 KByte 
address boundary. The memory space size can 
range from 4 KBytes to 16 MBytes. 

SMM memory space accesses can use address 
pipelining, and are always non-cacheable. SMM 
accesses ignore the state of the A20M# input pin 
and drive the A20 address bit to the unmasked 
value. 

Access to the SMM memory space can be made 
while not in SMM mode by setting the System 
Management Access (SMAC) bit in the CCR1 
register. This feature may be used to initialize the 
SMM memory space. 

While in SMM mode, SMADS# address strobes are 
generated instead of ADS# for SMM memory 
accesses. Any memory accesses outside the 
defined SMM space result in normal memory 
accesses and ADS# strobes. Data (non-code) 
accesses to main memory that overlap with 
defined SMM memory space are allowed if bit 3 in 
CCR1 (MMAC ) is set. In this case, ADS# strobes 
are generated for data accesses only and SMADS# 
strobes continue to be generated for code accesses. 



2.6.6 SMI Service Routine 
Execution 

Upon entry into SMM after the SMM header has 
been saved, the CRO, EFLAGS, and DR7 registers 
are set to their reset values. The Code Segment 
(CS) register is loaded with the base and limits 
defined by the ARR4 register and the SMI service 
routine begins execution at the SMM base address 
in real mode. 

The programmer must then save the value of any 
registers that may be changed by the SMI service 
routine. For data accesses immediately after 
entering the SMI service routine, the programmer 
must use CS as a segment override. I/O port 
access is possible during the routine but care must 
be taken to save registers modified by the I/O 
instructions. Before using a segment register, the 
register and the register's descriptor cache contents 
should be saved using the SVDC instruction. 
While executing in the SMM space, execution flow 
can transfer to normal memory locations. 

Hardware interrupts, (INTRs and NMIs), may be 
serviced during an SMI service routine. If inter- 
rupts are to be serviced while executing in the 
SMM memory space, the SMM memory space 
must be within the to 1 MByte address range to 
guarantee proper return to the SMI service routine 
after handling the interrupt. INTRs are automati- 
cally disabled when entering SMM since the IF flag 
is set to its reset value. However, NMIs remain 
enabled. If it is desired to disable NMI, it should be 
done immediately after entering the SMI service 
routine by the system hardware logic. 
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Within the SMI service routine, protected mode 
may be entered and exited as required, and real or 
protected mode device drivers can be called. 

To exit the SMI service routine, a Resume (RSM) 
instruction, rather than an IRET, is executed. The 
RSM instruction causes the Cx486SLC/e to restore 
the CPU state using the SMM header information 
and resume execution at the interrupted point. If 
the full CPU state was saved by the programmer, 
the stored values should be reloaded prior to 
executing the RSM instruction using the MOV and 
the RSDC, RSLDT and RSTS instructions. 

CPU States Related to SMM and Suspend 
Mode 

The state diagram shown in Figure 3-29 illustrates 
the various CPU states associated with SMM and 
suspend mode. While in the SMI service routine, 
the Cx486SLC/e can enter suspend mode either by 
(1) executing a HALT instruction or (2) by 
asserting the SUSP# input. 

During SMM operations and while in SUSP# 
initiated suspend mode, an occurrence of either 
NMI or INTR is latched. (In order for INTR to be 
latched, the IF flag must have been set.) The 
INTR or NMI is serviced after exiting suspend 
mode. 



2.7 Shutdown and Halt 

The halt instruction (HLT) stops program 
execution and prevents the processor from using 
the local bus until restarted. The Cx486SLC/e 
then enters a low-power suspend mode. SMI, 
NMI, INTR with interrupts enabled (IF bit in 
EFLAGS=1), or RESET forces the CPU- out of the 
halt state. If interrupted, the saved code segment 
and instruction pointer specify the instruction 
following the HLT. 

Shutdown occurs when a severe error is detected 
that prevents further processing. An NMI input 
can bring the processor out of shutdown if the IDT 
limit is large enough to contain the NMI interrupt 
vector (at least OOOFh) and the stack has enough 
room to contain the vector and flag information 
(i.e., stack pointer is greater than 0005h). Other- 
wise, shutdown can only be exited by a processor 
reset. 



If suspend mode is entered via a HALT instruction 
from the operating system or application software, 
the reception of an SMI# interrupt causes the CPU 
to exit suspend mode and enter SMM. If suspend 
mode is entered via the hardware (SUSP# = 0) 
while the operating system or application software 
is active, the CPU latches one occurrence of INTR, 
NMI and SMI#. 
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(INTR and NMI latched) 



Figure 2-29. SMM and Suspend Mode Flow Diagram 
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2.8 Protection 

Segment protection and page protection are 
safeguards built into the Cx486SLC/e protected 
mode architecture which deny unauthorized or 
incorrect access to selected memory addresses. 
These safeguards allow multitasking programs to 
be isolated from each other and from the operating 
system. Page protection is discussed earlier in this 
chapter in section 2.4. This section concentrates 
on segment protection. 

Selectors and descriptors are the key elements in 
the segment protection mechanism. The segment 
base address, size, and privilege level are estab- 
lished by a segment descriptor. Privilege levels 
control the use of privileged instructions, 
I/O instructions and access to segments and 
segment descriptors. Selectors are used to locate 
segment descriptors. 

Segment accesses are divided into two basic types, 
those involving code segments (e.g., control 
transfers) and those involving data accesses. The 
ability of a task to access a segment depends on: 

o the segment type 

© the instruction requesting access 

© the type of descriptor used to define the 

segment 
• the associated privilege levels 

(described below). 

Data stored in a segment can be accessed only by 
code executing at the same or a more privileged 
level. A code segment or procedure can only be 
called by a task executing at the same or a less 
privileged level. 



2.8.1 . Privilege Levels 

The values for privilege levels range between 
and 3. Level is the highest privilege level (most 
privileged), and level 3 is the lowest privilege level 
(least privileged). The privilege level in real mode 
is effectively 0. 

The Descriptor Privilege Level (DPL) is the 
privilege level defined for a segment in the seg- 
ment descriptor. The DPL field specifies the 
minimum privilege level needed to access the 
memory segment pointed to by the descriptor. 

The Current Privilege Level (CPL) is defined as 
the current task's privilege level. The CPL of an 
executing task is stored in the hidden portion of 
the code segment register and essentially is the 
DPL for the current code segment. 

The Requested Privilege Level (RPL) specifies a 
selector's privilege level and is used to distinguish 
between the privilege level of a routine actually 
accessing memory (the CPL), and the privilege 
level of the original requestor (the RPL) of the 
memory access. The lesser of the RPL and CPL is 
called the effective privilege level (EPL). There- 
fore, if RPL = in a segment selector, the effective 
privilege level is always determined by the CPL. 
If RPL = 3, the effective privilege level is always 3 
regardless of the CPL. 

For a memory access to succeed, the effective 
privilege level (EPL) must be at least as privileged 
as the descriptor privilege level (EPL < DPL). If 
the EPL is less privileged than the DPL (EPL > 
DPL), a general protection fault is generated. For 
example, if a segment has a DPL = 2, an instruc- 
tion accessing the segment only succeeds if 
executed with an EPL < 2. 
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2.8.2 I/O Privilege Levels 

The I/O Privilege Level (IOPL) allows the 
operating system executing at CPL=0 to define the 
least privileged level at which IOPL-sensitive 
instructions can unconditionally be used. The 
IOPL-sensitive instructions include CLI, IN, OUT, 
INS, OUTS, REP INS, REP OUTS, and STL 
Modification of the IF bit in the EFLAGS register 
is also sensitive to the I/O privilege level. 

The IOPL is stored in the EFLAGS register. An 
I/O permission bit map is available as defined by 
the 32-bit Task State Segment (TSS). Since each 
task can have its own TSS, access to individual 
I/O ports can be granted through separate I/O 
permission bit maps. 

If CPL < IOPL, IOPL-sensitive operations can be 
performed. If CPL > IOPL, a general protection 
fault is generated if the current task is associated 
with a 16-bit TSS. If the current task is associated 
with a 32-bit TSS and CPL > IOPL, the CPU 
consults the I/O permission bitmap in the TSS to 
determine on a port-by-port basis whether or not 
I/O instructions (IN, OUT, INS, OUTS, REP INS, 
REP OUTS) are permitted, and the remaining 
IOPL-sensitive operations generate a general 
protection fault. 



2.8.3 Privilege Level Transfers 

A task's CPL can be changed only through inter- 
segment control transfers using gates or task 
switches to a code segment with a different 
privilege level. Control transfers result from 
exception and interrupt servicing and from 
execution of the CALL, JMP, INT, IRET and RET 
instructions. 

There are five types of control transfers that are 
summarized in Table 2-23. Control transfers can 
be made only when the operation causing the 
control transfer references the correct descriptor 
type. Any violation of these descriptor usage rules 
causes a general protection fault. 
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Table 2-23. Descriptor Types Used for Control Transfer 



TYPE OF CONTROL TRANSFER 


OPERATION 
TYPES 


DESCRIPTOR 
REFERENCED 


DESCRIPTOR 
TABLE 


Intersegment within the same privilege level. 


JMP, CALL, RET, IRET* 


Code Segment 


GDT or LDT 


Intersegment to the same or a more 
privileged level. 

Interrupt within task (could change CPL 
level). 


CALL 


Call Gate 


GDT or LDT 


Interrupt Instruction, 
Exception, External 
Interrupt 


Trap or Interrupt 
Gate 


IDT 


Intersegment to a less privileged level 
(changes task CPL). 


RET, IRET* 


Code Segment 


GDT or LDT 


Task Switch via TSS 


CALL, JMP 


Task State Segment 


GDT 


Task Switch via Task Gate 


CALL, JMP 


Task Gate 


GDT or LDT 


IRET**, Interrupt 
Instruction, Exception, 
External Interrupt 


Task Gate 


IDT 



* NT (Nested Task bit in EFLAGS) = 
** NT (Nested Task bit in EFLAGS) = 1 



Any control transfer that changes the CPL within a 
task results in a change of stack. The initial values 
for the stack segment (SS) and stack pointer (ESP) 
for privilege levels 0,1, and 2 are stored in the 
TSS. During a JMP or CALL control transfer, the 
SS and ESP are loaded with the new stack pointer 
and the previous stack pointer is saved on the new 
stack. When returning to the original privilege 
level, the RET or IRET instruction restores the 
less-privileged stack. 



2.8.3.1 Gates 

Gate descriptors provide protection for privilege 
transfers among executable segments. Gates are 
used to transition to routines of the same or a 
more privileged level. Call gates, interrupt gates 
and trap gates are used for privilege transfers 
within a task. Task gates are used to transfer 
between tasks. 

Gates conform to the standard rules of privilege. 
In other words, gates can be accessed by a task if 
the effective privilege level (EPL) is the same or 
more privileged than the gate descriptor's privilege 
level (DPL). 
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2.8.4 Initialization and 

Transition to Protected 
Mode 

The Cx486SLC/e microprocessor switches to real 
mode immediately after RESET. While operating in 
real mode, the system tables and registers should be 
initialized. The GDTR and IDTR must point to a 
valid GDT and IDT, respectively. The size of the 
IDT should be at least 256 bytes, and the GDT must 
contain descriptors which describe the initial code 
and data segments. 

The processor can be placed in protected mode by 
setting the PE bit in the CRO register. After enabling 
protected mode, the CS register should be loaded 
and the instruction decode queue should be flushed 
by executing an intersegment JMP. Finally, all data 
segment registers should be initialized with appropri- 
ate selector values. 
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Both real mode and virtual 8086 (V86) mode are 
supported by the Cx486SLC/e CPU allowing execu- 
tion of 8086 application programs and 8086 operat- 
ing systems. V86 Mode allows the execution of 
8086-type applications, yet still permits use of the 
Cx486SLC/e protection mechanism. V86 tasks run 
at privilege level 3. Upon entry, all segment limits 
are set to FFFFh (64K) as in real mode. 

2.9. 1 Memory Addressing 

While in V86 mode, segment registers are used in an 
identical fashion to real mode. The contents of the 
segment register are multiplied by 16 and added to 
the offset to form the segment base linear address. 
The Cx486SLC/e CPU permits the operating system 



to select which programs use the V86 address 
mechanism and which programs use protected 
mode addressing for each task. 

The Cx486SLC/e also permits the use of paging 
when operating in V86 mode. Using paging, 
the 1 -MByte address space of the V86 task can 
be mapped to anywhere in. the 4-GByte linear 
address space of the Cx486SLC/e CPU. As in 
real mode, linear addresses that exceed 
1 MByte cause a segment limit overrun excep- 
tion. 

The paging hardware allows multiple V86 tasks 
to run concurrently, and provides protection 
and operating system isolation. The paging 
hardware must be enabled to run multiple 
V86 tasks or to relocate the address space of a 
V86 task to physical address space greater than 
1 MByte. 

2.9.2 Protection 

All V86 tasks operate with the least amount of 
privilege (level 3) and are subject to all of the 
Cx486SLC/e protected mode protection 
checks. As a result, any attempt to execute a 
privileged instruction within a V86 task results 
in a general protection fault. 

In V86 mode, a slightly different set of instruc- 
tions are sensitive to the I/O privilege level 
(IOPL) than in protected mode. These instruc- 
tions are: CLI, INT n, IRET, POPF, PUSHF, 
and STL The INT3, INTO and BOUND 
variations of the INT instruction are not IOPL 
sensitive. 
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2.9.3 Bnteo-ropt Handling 

To fully support the emulation of an 8086-type 
machine, interrupts in V86 mode are handled as 
follows. When an interrupt or exception is 
serviced in V86 mode, program execution trans- 
fers to the interrupt service routine at privilege 
level (i.e., transition from V86 to protected 
mode occurs) and the VM bit in the EFLAGS 
register is cleared. The protected mode interrupt 
service routine then determines if the interrupt 
came from a protected mode or V86 application 
by examining the VM bit in the EFLAGS image 
stored on the stack. The interrupt service routine 
may then choose to allow the 8086 operating 
system to handle the interrupt or may emulate the 
function of the interrupt handler. Following 
completion of the interrupt service routine, an 
1RET instruction restores the EFLAGS register 
(restores VM=1) and segment selectors and control 
returns to the interrupted V86 task. 



2.9.4 Entering and Leaving 
V86 Mode 

V86 mode is entered from protected mode by 
either executing an 1RET instruction at CPL = or 
by task switching. If an IRET is used, the stack 
must contain an EFLAGS image with VM= 1 . If a 
task switch is used, the TSS must contain an 
EFLAGS image containing a 1 in the VM bit 
position. The POPF instruction cannot be used to 
enter V86 mode since the state of the VM bit is 
not affected. V86 mode can only be exited as the 
result of an interrupt or exception. The transition 
out must use a 32-bit trap or interrupt gate which 
must point to a non-conforming privilege level 
segment (DPL = 0), or a 32-bit TSS. These 
restrictions are required to permit the trap handler 
to IRET back to the V86 program. 
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3. BUS INTERFACE 

3. 1 Overview 

The following sections describe the Cx486SLC/e input and output signals. The signals are described in 
the same order as they are listed in Figure 3-1. The discussion of these signals is arranged by functional 
groups as shown in Figure 3-1 and Table 3-1. 
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Table 3-1. Cx486SLC/e Signal Summary 



SIGNAL 


SIGNAL NAME 


SIGNAL GROUP 


A20M# 


ADDRESS BIT 20 MASK 




A23-A1 


ADDRESS BUS LINES 


Address Bus 


ADS# 


ADDRESS STROBE 


Bus Cycle Control 


BHE# 


BYTE HIGH ENABLE 


Address Bus 


BLE# 


BYTE LOW ENABLE 


Address Bus 


TJT TCV-W- 

pUbY# 


PROCESSOR EXTENSION BUSY 


Coprocessor Interface 


CLK2 


2X CLOCK INPUT 




D15-D0 


DATA BUS 




D/C# 


DATA/CONTROL 


Bus Cycle Definition 


hKRUKff 


PROCESSOR EXTENSION ERROR 


Coprocessor Interface 


FLT# 


FLOAT 





rLUbri# 


CACHE FLUSH 


Internal Cache Interface 


HLDA 


HOLD ACKNOWLEDGE 


Bus Arbitration 


HOLD 


HOLD REQUEST 


Bus Arbitration 


INTR 


MASKABLE INTERRUPT REQUEST 


Interrupt Control 


KEN# 


CACHE ENABLE 


Internal Cache Interface 


t nrvtf 


BUS LOCK 


Bus Cycle Definition 


IVl/lUff 


MhMURY/INr U 1 -UU I rU 1 


Bus Cycle Definition 


NA# 


ktfyt Ar>nPFc:c ppot tf<;t 

InHAI nUUKCjj JSIlv^UCol 


DUb V^yLlC ^UIlLIOl 


NMI 


NON-MASKABLE INTERRUPT REQUEST 


Interrupt Control 


PEREQ 


PROCESSOR EXTENSION REQUEST 


Coprocessor Interface 


READY# 


BUS READY 


Bus Cycle Control 


RESET 


RESET 




RPLSET 


REPLACEMENT SET 


Internal Cache Interface 


RPLVAL# 


REPLACEMENT SET VALID 


Internal Cache Interface 


SMADS# 


SMM ADDRESS STROBE 


Bus Cycle Control 


SMI# 


SYSTEM MANAGEMENT INTERRUPT 


Interrupt Control 


SUSP# 


SUSPEND REQUEST 


Power Management 


SUSPA# 


SUSPEND ACKNOWLEDGE 


Power Management 


W/R# 


. WRITE/READ 


Bus Cycle Definition 



The pound symbol "#" following a signal name 
indicates that when the signal is in its active 
(asserted) state, the signal is at a logic low level. 
When the "#" is not present at the end of a signal 
name, the logic high level represents the active 



state. The following two sections describe the 
signals and their functional timing characteristics. 
Additional signal information may be found in 
Chapter 4, Electrical Specifications. Chapter 4 
documents the DC and AC characteristics for the 
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signals including voltage levels, propagation 
delays, setup times and hold times. Specified 
setup and hold times must be met for proper 
operation of the Cx486SLC/e. 

3.2 Signal Descriptions 

3.2.1 2X Clock Input 

The 2X Clock Input (CLK2) signal is the basic 
timing reference for the Cx486SLC/e micropro- 
cessor. The CLK2 input is internally divided 
by two to generate the internal processor clock. 
The external CLK2 is synchronized to a known 
phase of the internal processor clock by the falling 
edge of the RESET signal. External timing param- 
eters are defined with respect to the rising edge of 
CLK2 

3.2.2 Reset 

Reset is an active high input signal that, when 
asserted, suspends all operations in progress and 
places the Cx486SLC/e into a reset state. RESET is 
a level-sensitive synchronous input and must meet 
specified setup and hold times to be properly 
recognized by the Cx486SLC/e . The 
Cx486SLC/e begins executing instructions at 
physical address location FF FFFOh approxi- 
mately 400 CLK2's after RESET is driven inactive 
(low). While RESET is active all other input pins, 
except FLT#, are ignored. The remaining signals 
are initialized to their reset state during the inter- 
nal processor reset sequence. The reset signal 
states for the Cx486SLC/e are shown in Table 3-2. 



Table 3-2. Signal States During Reset 



SIGNAL NAME 


SIGNAL STATE DURING RESET 


a i r\\ /Til 

A20M# 


Ignored 


A23-A1 


1 


ADS# 


1 


T>T TT7JJ. Til T7 XI 

BHE#, BLE# 





BUSY# 


Initiates Self Test 


D15-D0 


Float 


D/C# 


1 


ERROR# 


Ignored 


FLT# 


Input Recognized 


T— T T Tr*T T XL 

FLU5H# 


Ignored 


HLDA 





HOLD 


Ignored 


INTR 


Ignored 


KEN# 


Ignored 


LULM 


i 
i 


A/T/TOif 
Ni/LKJff 


u 


NA# 


Tnmorprl 


NMI 


Ignored 


PEREQ 


Ignored 


READY# 


Ignored 


RESET 


Input Recognized 


RPLSET 


Float 


RPLVAL# 


Float 


SMADS# 


Float 


SMI# 


Ignored 


SUSP# 


Ignored 


SUSPA# 


Float 


W/R# 
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3.2.3 Data Bus 

The Data Bus (D15-D0) signals are three-state 
bidirectional signals which provide the data path 
between the Cx486SLC/e and external memory 
and I/O devices. The data bus inputs data during 
memory read, I/O read and interrupt acknowl- . 
edge cycles and outputs data during memory and 
I/O write cycles. Data read operations require that 
specified data setup and hold times be met for 
correct operation. The data bus signals are high 
active and float while the CPU is in a hold ac- 
knowledge or float state. 

3.2.4 Address Bus 

The Address Bus (A23-A1) signals are three- 
state outputs that provide addresses for physical 
memory and I/O ports. All address lines can be 
used for addressing physical memory allowing a 
16 MByte address space (00 OOOOh to FF FFFFh). 
During I/O port accesses, A23-A16 are driven low 
(except for coprocessor accesses). This permits a 
64 KByte I/O address space (00 OOOOh to • 
00 FFFFh). 

During all coprocessor I/O accesses address lines 
A22-A16 are driven low and A23 is driven high. 
This allows A23 to be used by external logic to 
generate a coprocessor select signal. Coprocessor 
command transfers occur with address 80 00F8h 
and coprocessor data transfers occur with ad- 
dresses 80 OOFCh and 80 OOFEh. A23-A1 float 
while the CPU is in a hold acknowledge or float 
state. 

Byte Low Enable (BLE#) and Byte High 
Enable (BHE#) are three-state outputs that 
indicate which byte(s) of the 16-bit data bus will 
be selected for data transfer during the current bus 
cycle (Table 3-3). BLE# selects the low byte (D7- 
D0) and BHE# selects the high byte (D15-D8). 



When BHE# and BLE# are asserted, both bytes (all 
16 bits) of the data bus are selected. BLE# and 
BHE# float while the CPU is in a hold acknowl- 
edge or float state. 



Table 3-3. Byte Enable Definitions 



BHE# 


BLE# 


FUNCTION 








Word transfer -D15-D0 





1 


Upper byte transfer - D15-D8 


1 





Lower byte transfer - D7-D0 


1 


1 


Never occurs during a bus cycle 



3.2.5 Bus Cycle Definition 

The bus cycle definition signals (M/IO#, D/C#, 
W/R#, LOCK#) consist of four three-state outputs 
which define the bus cycle type to be performed. 

Memory/IO (M/IO#) is low during I/O read and 
write cycles and is high during memory cycles. 

Data/Control (D/C#) is low during control 
cycles and is high during data cycles. Control 
cycles are issued during functions such as a halt 
instruction, interrupt servicing and code fetching. 
Data bus cycles include data access from either 
memory or I/O. 

Write/Read (W/R#) is low during read cycles 
(data is read from memory or I/O) and is high 
during write bus cycles (data is written to memory 
or I/O). . 

LOCK# is asserted to deny control of the CPU 
bus to other bus masters. The LOCK# signal may 
be explicitly activated during bus operations by 
including the LOCK prefix on certain instructions. 
LOCK# is always asserted during descriptor and 
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page table updates, interrupt acknowledge se- 
quences and when executing the XCHG instruc- 
tion. The Cx486SLC/e does not enter the hold 
acknowledge state in response to HOLD while the 
LOCK# input is active. 

The possible states for the bus cycle definition 
signals are listed in Table 3-4. The primary bus 
cycle definition signals (M/IO#, D/C# and W/R#) 
are driven valid when ADS# (Address Strobe) is 
asserted. 

During non-pipelined cycles, the LOCK# output 
is driven valid along with M/10#, D/C# and 
W/R#. During pipelined addressing; LOCK# is 
driven at the beginning of the bus cycle, which is 
after ADS# is asserted for that cycle. The bus cycle 
definition signals float while the Cx486SLC/e is 
in a hold acknowledge or float state. 



3.2.6 Bus Cycle Control 

The bus cycle control signals (ADS#, SMADS#, 
READY#, NA#) allow the Cx486SLC/e to indicate 
the beginning of a bus cycle and allow system 
hardware to control address pipelining and bus 
cycle termination timing. 

Address Strobe (ADS#) is a three-state output 
which indicates that the Cx486SLC/e has driven a 
valid address (A23-A1, BHE#, BLE#) and bus 
cycle definition (M/IO#, D/C#, W/R#) on the 
appropriate Cx486SLC/e output pins. During 
non-pipelined bus cycles, ADS# is active for the 
first clock of the bus cycle. During address 
pipelining, ADS# is asserted during the previous 
bus cycle and remains asserted until READY# is 
returned for that cycle. ADS# floats while the 
Cx486SLC/e is in a hold acknowledge or float 
state. 



Table 3-4. Bus Cycle Types 



M/IO# 


D/C# 


W/R# 


LOCK# 


BUS CYCLE TYPE 














Interrupt Acknowledge 











1 










1 


X 







1 


X 










1 





1 


I/O Data Read 





1 


1 


1 


I/O Data Write 




.0 


X 















1 


Memory Code Read 







1 


1 


Halt: A23-A1 = 2h, BHE# = 1 and BLE# = 
Shutdown: A23-A1 = Oh, BHE# = 1 and BLE# = 




1 


• 





Locked Memory Data Read 




1 





1 


Memory Data Read 




1 


1 





Locked Memory Data Write 




1 


1 


1 


Memory Data Write 



X = don't care, — = does not occur 
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SMM Address Strobe (SMADS#) is asserted 
instead of the ADS# during SMM bus cycles and 
indicates that SMM memory is being accessed. 
SMADS# floats while the CPU is in a hold 
acknowledge or float state. The SMADS# output 
is disabled (floated) following reset and can be 
enabled using the SMI bit in the CCR1 
configuration register. 

Ready (READY#) is an input generated by the 
system hardware that indicates that the current 
bus cycle can be terminated. During a read cycle, 
assertion of READY# indicates that the system 
hardware has presented valid data to the CPU. 
When READY# is sampled active, the 
Cx486SLC/e latches the input data and terminates 
the cycle. During a write cycle ,-READY# assertion 
indicates that the system hardware has accepted 
the Cx486SLC/e output data. READY# must be 
asserted to terminate every bus cycle, including 
halt and shutdown indication cycles. 

Next Address Request (NA#) is an input used 
to request address pipelining by the system 
hardware. When asserted, the system indicates 
that it is prepared to accept new bus cycle defini- 
tion and address signals (M/IO#, D/C#, W/R#, 
A23-A1, BHE#, and BLE#) from the microproces- 
sor even if the current bus cycle has not been 
terminated by assertion of READY#. If the 
Cx486SLC/e has an internal bus request pending 
and the NA# input is sampled active, the next bus 
cycle definition and address signals are driven 
onto the bus. 

3.2.7 Interrupt Control 

The interrupt control input signals (INTR, NMI, 
SMI#) allow the execution of the Cx486SLC/e's 
current instruction stream to be interrupted and 
suspended. 



Maskable Interrupt Request (INTR) is a level- 
sensitive input which causes the processor to 
suspend execution of the current instruction 
stream and begin execution of an interrupt service 
routine. The INTR input can be masked 
(ignored) through the Flags Register IF bit. When 
unmasked, the Cx486SLC/e responds to the INTR 
input by issuing two locked interrupt 
acknowledge cycles. To assure recognition of the 
INTR request, INTR must remain active until the 
start of the first interrupt acknowledge cycle. 

Non-maskable Interrupt Request (NMI) is a 

rising-edge sensitive input which causes the 
processor to suspend execution of the current 
instruction stream and begin execution of an NMI 
interrupt service routine. The NMI interrupt 
service request cannot be masked by the software. 
Asserting NMI causes an interrupt which inter- 
nally supplies interrupt vector 2h to the CPU core. 
External interrupt acknowledge cycles are not 
necessary since the NMI interrupt vector is sup- 
plied internally. 

The Cx486SLC/e samples NMI at the beginning of 
each phase 2. To assure recognition, NMI must 
be inactive for at least eight CLK2 periods and 
then be active for at least eight CLK2 periods. 
Additionally, specified setup and hold times must 
be met to guarantee recognition at a particular 
clock edge. 

System Management Interrupt (SMI#) is a 

bidirectional signal and level sensitive interrupt 
with higher priority than the NMI interrupt. SMI# 
must be active for at least four CLK2 clock periods 
to be recognized by the Cx486SLC/e. After the 
SMI# interrupt is acknowledged, the SMI# pin is 
driven low by the Cx486SLC/e for the duration of 
the SMI service routine. The SMI# input is 
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ignored following reset and can be enabled using 
the SMI bit in the CCR1 configuration register. 

3.2.8 Internal Cache interface 

The internal cache interface signals (KEN#, 
FLUSH#, RPLSET, RPLVAL#) indicate cache 
status and control caching activity. 

Cache Enable (KEN#) is an input which indi- 
cates that the data being returned during the 
current cycle is cacheable. When KEN# is active 
and the Cx486SLC/e is performing a cacheable 
code fetch or memory data read cycle, the cycle is 
transformed into a cache fill. Use of the KEN# 
input to control cacheability is optional. The non- 
cacheable region registers can also be used to 
control cacheability. Memory addresses specified • 
by the non-cacheable region registers are not 
cacheable regardless of the state of KEN#. I/O 
accesses, locked reads, SMM address space 
accesses, and interrupt acknowledge cycles are 
never cached. 

During cached code fetches, two contiguous read 
cycles are performed to completely fill the 4-byte 
cache line. KEN# must be asserted during both 
read cycles in order to cause a cache line fill. 
During-cached data reads, the Cx486SLC/e 
performs only those bus cycles necessary to 
supply the required data to complete the current 
operation. Valid bits are maintained for each byte 
in the cache line, thus allowing data operands of 
less than 4 bytes to reside in the cache. 

During any cache fill cycle with KEN# asserted, 
the Cx486SLC/e ignores the state of the byte 
enables (BHE# and BLE#) and always writes two 
bytes of data into the cache. The KEN# input is 
ignored following reset and can be enabled using 
the KEN bit in the CCRO configuration register. 



Cache Flush (FLUSH#) is an input which 
invalidates (flushes) the entire cache. Use of 
FLUSH# to maintain cache coherency is optional. 
The cache may also be invalidated during each 
hold acknowledge cycle by setting the BARB bit in 
the CCRO configuration register. The FLUSH# 
input is ignored following reset and can be 
enabled using the FLUSH bit in the CCRO con- 
figuration register. 

Replacement Set (RPLSET) is an output 
indicating which set in the cache is currently 
undergoing a line replacement. This signal is 
meaningful only when the internal cache is 
configured as two-way set associative. The 
RPLSET output is disabled (three-state) following 
reset and can be enabled using the RPL bit in the 
CCR1 configuration register. RPLSET floats 
during CPU hold acknowledge and float states. 

Replacement Set Valid (RPLVAL#) is an 

output driven during a cache fill cycle to indicate 
that RPLSET is valid for the current cycle. 
RPLVAL# and RPLSET provide external hardware 
the capability of monitoring the cache LRU 
replacement algorithm. The RPLVAL# output is 
disabled (three-state) following reset and can be 
enabled using the RPL bit in the CCR1 configura- 
tion register. RPLVAL# floats during CPU hold 
acknowledge and float states. 
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3.2.9 Address Bit 20 Mask 

Address Bit 20 Mask (A20M#) is an active low 
input which causes the Cx486SLC/e to mask 
(force low) physical address bit 20 when driving 
the external address bus or performing an internal 
cache access. When the processor is in real mode, 
asserting A20M# emulates the 1 MByte address 
wrap around that occurs on the 8086. The A20 
signal is never masked when paging is enabled 
regardless of the state of the A20M# input. The 
A20M# input is ignored following reset and can 
be enabled using the A20M bit in the CCRO 
configuration register. 

3.2. 1 Coprocessor Interface 

The data bus, address bus and bus cycle definition 
signals, as well as the coprocessor interface signals 
(PEREQ, BUSY#, ERROR#), are used to control 
communication between the Cx486SLC/e and a 
coprocessor. Coprocessor or ESC opcodes are 
decoded by the Cx486SLC/e and the opcode and 
operands are then transferred to the coprocessor 
via I/O port accesses to addresses 80 00F8h, 
80 OOFCh or 80 OOFEh. 80 00F8h functions as 
the control port address and 80 OOFCh and 
80 OOFEh are used for operand transfers. Addi- 
tional handshaking is provided using the three 
dedicated control signals described below. 

Coprocessor Request (PEREQ) is an active high 
input which indicates the coprocessor is ready to 
transfer data to or from the CPU. The coproces- 
sor may assert PEREQ in the process of executing 
a coprocessor instruction. The Cx486SLC/e 
internally stores the current coprocessor opcode 
and performs the correct data transfers to support 
coprocessor operations using PEREQ to synchro- 



nize the transfer of required operands. PEREQ is 
internally connected to a pull-down resistor to 
prevent this signal from floating active when left 
unconnected. 

Coprocessor Busy (BUSY#) is an active low 
input from the coprocessor which indicates to the 
Cx486SLC/e that the coprocessor is currently 
executing an instruction and is not yet able to 
accept another opcode. When the Cx486SLC/e 
processor encounters a WAIT instruction or any 
coprocessor instruction which operates on the 
coprocessor stack (e.g. load, pop, arithmetic 
operation), BUSY# is sampled. BUSY# is continu- 
ally sampled and must be recognized as inactive 
before the CPU will supply the coprocessor with 
another instruction. However, the following 
coprocessor instructions are allowed to execute 
even if BUSY# is active since these instructions are 
used for coprocessor initialization and exception 
clearing: 

FN1NIT 

FNCLEX. 

BUSY# is internally connected to a pull-up resistor 
to prevent it from floating active when left 
unconnected. 

Coprocessor Error (ERROR#) is an active low 
input used to indicate that the coprocessor 
generated an error during execution of a copro- 
cessor instruction. ERROR# is sampled by the 
Cx486SLC/e processor whenever a coprocessor 
instruction is executed. If ERROR# is sampled 
active, the processor generates exception 16 which 
is then serviced by the exception handling soft- 
ware. 

Certain coprocessor instructions do not 
generate an exception 16 even if ERROR# is 
active. These instructions, which involve clearing 
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coprocessor error flags and saving the coprocessor 
state, are listed below: 

FN1N1T 

FNCLEX 

FNSTSW 

FNSTCW 

FNSTENV 

FNSAVF 

ERROR# is internally connected to a pull-up 
resistor to prevent it from floating active when left 
unconnected. 

3.2.1 1 Bus Arbitration 

The bus arbitration (HOLD, HLDA) signals allow 
the Cx486SLC/e to relinquish control of its local 
bus when requested by another bus master device. 
Once the processor has relinquished its bus 
(three-stated), the bus master device can then 
drive the local bus signals. 

Hold Request (HOLD) is an active high input 
used to indicate that another bus master requests 
control of the local bus. After recognizing the 
HOLD request and completing the current bus 
cycle or sequence of locked bus cycles, the 
Cx486SLC/e responds by floating the local bus 
and asserting the hold acknowledge (HLDA) 
output. 

Once HLDA is asserted, the bus remains granted 
to the requesting bus master until HOLD becomes 
inactive. When the Cx486SLC/e recognizes 
HOLD is inactive, it simultaneously drives the 
local bus and drives HLDA inactive. External 
pull-up resistors may be required on some of the 
Cx486SLC/e three-state outputs to guarantee that 
they remain inactive while in a hold acknow- 
ledge state. 



The HOLD input is not recognized while RESET 
is active. If HOLD is asserted while RESET is 
active, RESET has priority and the Cx486SLC/e 
places the bus into an idle state instead of a hold , 
acknowledge state. The HOLD input is also 
recognized during suspend mode provided the 
CLK2 input has not been stopped. HOLD is 
level-sensitive and must meet specified setup and 
hold times for correct operation. 

Hold Acknowledge (HLDA) is an active high 
output which indicates that the Cx486SLC/e is in 
a hold acknowledge state and has relinquished 
control of its local bus. While in the hold ac- 
knowledge state, the Cx486SLC/e drives HLDA 
active and continues to drive SUSPA#, if enabled. 
The other Cx486SLC/e outputs are in a high- 
impedance state allowing the requesting bus 
master to drive these signals. If the on-chip cache 
can satisfy bus requests, the Cx486SLC/e contin- 
ues to operate during hold acknowledge states. 
A20M# is internally recognized during this time. 

The processor deactivates HLDA when the HOLD 
request is driven inactive. The Cx486SLC/e stores 
one NM1 rising edge during a hold acknowledge 
state for processing after HOLD is inactive. The 
FLUSH# input is also recognized during a hold 
acknowledge state. If SUSP# is asserted during a 
hold acknowledge state, the Cx486SLC/e may or 
may not enter suspend mode depending on the 
state of the internal execution pipeline. Table 3-5 
summarizes the state of the Cx486SLC/e signals 
during hold acknowledge. 
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Table 3-5. Signal States During Hold 
Acknowledge 



SIGNAL NAME 


SIGNAL STATE DURING HOLD 
ACKNOWLEDGE 


AZUMff 


Input Recognized 


A 11 A 1 

Azj-AI 


Float 


a r\Ctt 
AJJoff 


Float 




Float 


DUO Iff 


Ignored. 


U1J-1JU 


Float 


rv^fY 
D/L>f7 


Float 




Ignored 


FLT# 


Input Recognized 


"RT T TCT-T-W- 
rLUotlff 


Input Recognized 


T_TT r\ A 

JrlLJJA 


i 
i 


rlULJJ 


Input Recognized 


TXTTD 
UN IK 


Input Recognized 


i\E, INff 


Ignored 




Float 


M/IO# 


Float 


NA# 


Tonnrpn 


NMI 


Input Recognized 


PEREQ 


Ignored 


READY# 


Ignored 


RESET 


Input Recognized 


RPLSET 


Float 


RPLVAL# 


Float 


SMADS# 


Float 


SMI# 


Input Recognized 


SUSP# 


Input Recognized 


SUSPA# 


Driven 


W/R# 


Float 



3.2. 1 2 Power Management 
Interface 

The power management signals allows the 
Cx486SLC/e to enter suspend mode. Suspend 
mode can also be entered as the result of executing a 



HALT instruction. Suspend mode circuitry allows 
the Cx486SLC/e to consume minimal power 
while maintaining the entire internal CPU state. 

Suspend Request (SUSP#) is an active low 
input which requests that the Cx486SLC/e enter 
suspend mode. After recognizing SUSP# active, the 
processor completes execution of the current 
instruction, any pending decoded instructions and 
associated bus cycles. In addition, the 
Cx486SLC/e waits for the coprocessor to indicate 
a not busy status (BUSY# = 1) before entering 
suspend mode and asserting suspend acknowl- 
edge (SUSPA#). During suspend mode, inter- 
nal clocks are stopped and only the logic associ- 
ated with monitoring RESET, HOLD and FLUSH# 
remains active. With SUSPA# asserted, the CLK2 
input to the Cx486SLC/e can be stopped in either 
phase. Stopping the CLK2 input further reduces 
current consumption of the Cx486SLC/e. 

To resume operation, the CLK2 input is restarted 
(if stopped), followed by negation of the SUSP# 
input. The processor then resumes instruction 
fetching and begins execution in the instruction 
stream at the point it had stopped. The SUSP# 
input is level sensitive and must meet specified 
setup and hold times to be recognized at a par- 
ticular clock edge. The SUSP# input is ignored 
following reset and can be enabled using the SUSP 
bit in the CCRO configuration register. 

The Suspend Acknowledge (SUSPA#) output 
indicates that the Cx486SLC/e has entered the 
suspend mode as a result of SUSP# assertion or 
execution of a HALT instruction. IfSUSPA#is 
asserted and the CLK2 input is switching, the 
Cx486SLC/e continues to recognize FLT#, 
RESET, HOLD and FLUSH#. If suspend mode 
was entered as the result of a HALT instruction, 
the Cx486SLC/e also continues to monitor the 



3-10 



PRELIMINARY 



Signal Descriptions 



3 



NMI, SMI# and unmasked INTR inputs. Detec- 
tion of an unmasked INTR, NMI or SMI# forces 
the Cx486SLC/e to exit suspend mode and begin 
execution of the appropriate interrupt service 
routine. The CLK2 input to the processor may be 
stopped after SUSPA# has been asserted to further 
reduce the current consumption of the 



Cx486SLC/e. The SUSPA# output is disabled 
(floated) following reset and can be enabled using 
the SUSP bit in the CCRO configuration register. 

Table 3-6 shows the state of the Cx486SLC/e 
signals when the device is in suspend mode. 



Table 3-6. Signal States During Suspend Mode 



SIGNAL NAME 


SIGNAL STATE DURING SUSP# 
INITIATED SUSPEND MODE 


SIGNAL STATE DURING HALT 
INITIATED SUSPEND MODE 


A20M# 


Ignored 


Ignored 


A23-A1 


1 


1 


ADS# 


1 • 


1 


BHE#, BLE# 


v 





BUSY# 


Ignored 


Ignored 


D15-D0 


Float 


Float 


D/C# ' 


1 


1 


ERROR# 


Ignored 


Ignored 


FLT# 


Input Recognized 


Input Recognized 


FLUSH# 


Input Recognized 


Input Recognized 


HLDA 








HOLD 


Input Recognized 


Input Recognized 


INTR 


Latched 


Input Recognized 


KEN# 


Ignored 


Ignored 


LOCK# 


1 


1 


M/IO# 








NA# 


Ignored 


Ignored 


NMI 


Latched 


Input Recognized 


PEREQ 


Ignored 


Ignored 


READY# 


Ignored 


Ignored 


RESET 


Input Recognized 


Input Recognized 


RPLSET 


Driven 


Driven 


RPLVAL# 


Driven 


Driven 


SMADS# 


1 


1 


SMI# 


Latched 


Input Recognized 


SUSP# 


Input Recognized 


Ignored 


SUSPA# 


o 





W/R# 









PRELIMINARY 



3-11 



Functional Timing 



3.2. 1 3 Float Control (FLT#) 

Float (FLT#) is an active low input which forces 
all bidirectional and output signals to a tri-state 
condition. Floating the signals allows the 
Cx486SLC/e signals to be externally driven 
without physically removing the device from the 
circuit. The Cx486SLC/e CPU must be reset 
following assertion or deassertion of FLT#. It is 
recommended that FLT# be used only for test 
purposes. 

3.3 Functional Timing 

3.3.1 Reset Timing and 
Internal Clock 
Synchronization 

RESET is the highest priority input signal and is 
capable of interrupting any processor activity 
when it is asserted. When RESET is asserted, the 
Cx486SLC/e aborts any bus cycle. Idle, hold 
acknowledge and suspend states are also discon- 
tinued and the reset state is established. RESET is 
used when the Cx486SLC/e microprocessor is 



( 

powered up to initialize the CPU to a known valid 
state and to synchronize the internal CPU clock 
with external clocks. 

RESET must be asserted for at least 15 CLK2 
periods to ensure recognition by the Cx486SLC/e 
microprocessor. If the self-test feature is to be 
invoked, RESET must be asserted for at least 80 
CLK2 periods. RESET pulses less than 15 CLK2 
periods may not have sufficient time to propagate 
throughout the Cx486SLC/e and may not be 
recognized. RESET pulses less than 80 CLK2 
periods followed by a self-test request may incor- 
rectly report a self-test failure when no true failure 
exists. 

Provided the RESET falling edge meets specified 
setup and hold times, the internal processor clock 
phase is synchronized as illustrated in Figure 3-2. 
The internal processor clock is half the frequency 
of the CLK2 input and each CLK2 cycle corre- 
sponds to an internal CPU clock phase. Phase 2 
of the internal clock is defined to be the second 
rising edge of CLK2 following the falling edge of 
RESET. 




CLK2 [ 
RESET [ 



Clock 



01 OR 02 01 OR 02 02 



01 



Figure 3-2. Internal Processor Clock Synchronization 
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Following the falling edge of RESET (and after 
self-test if it was requested), the Cx486SLC/e 
microprocessor performs an internal initialization 
sequence for approximately 400 CLK2 periods. 
The Cx486SLC/e self-test feature is invoked if the 
BUSY# input is an active low state when RESET 
falls inactive. The self- test sequence requires 
approximately (2 20 + 60) CLK2 periods to com- 
plete. Even if the self-test indicates a problem, the 
Cx486SLC/e microprocessor attempts to proceed 



with the reset sequence. Figure 3-3 illustrates the 
bus activity and timing during the Cx486SLC/e 
reset sequence. 

Upon completion of self-test, the EAX register 
contains 0000 OOOOh if the Cx486SLC/e micro- 
processor passed its internal self-test with no 
problems detected. Any non-zero value in the 
EAX register indicates that the microprocessor is 
faulty. 
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Figure 3-3. Bus Activity from RESET until First Code Fetch 
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3.3.2 Bus Operation 

The Cx486SLC/e microprocessor communicates 
with the external system through separate, parallel 
buses for data and address. This is commonly 
called a demultiplexed address/data bus. This 
demultiplexed bus eliminates the need for address 
latches required in multiplexed address/data bus 
configurations where the address and data are 
presented on the same pins at different times. 

Cx486SLC/e instructions can act on memory data 
operands consisting of 8-bit bytes, 16-bit words 
or 32-bit double words. The Cx486SLC/e bus 
architecture allows for bus transfers of these 
operands without restrictions on physical address 
alignment. Any byte boundary alignment is 
permissible. Operands not aligned on a word 
boundary may require more than one bus cycle to 
transfer the operand. This feature is transparent 
to the programmer. 

The Cx486SLC/e data bus (D15-D0) is a 16-bit 
wide bidirectional bus. The Cx486SLC/e drives 
the data bus during write bus cycles and the 
external system hardware drives the data bus 
during read bus cycles. The address bus provides 
a 24-bit value using 23 signals for the 23 upper- 
order address bits (A23-A1), defining which 16- 
bit word is being accessed, and two byte enable 
signals (BHE# and BLE#) to directly indicate 
which of the two bytes within the word are active. 

Every bus cycle begins with the assertion of the 
address strobe (ADS#). ADS# indicates that the 
Cx486SLC/e has issued a new address and new 
bus cycle definition signals. A bus cycle is defined 
by four signals: M/IO#, W/R#, D/C# and LOCK#. 
M/IO# defines if a memory or I/O operation is 



occurring, W/R# defines the cycle to be read or 
write, and D/C# indicates whether a data or control 
cycle is in effect. LOCK# indicates that the 
current cycle is a locked bus cycle. Every bus 
cycle completes when the system hardware 
returns READY# asserted. 

The Cx486SLC/e performs the following bus cycle 
types: 

Memory Read 

Locked Memory Read 

Memory Write 

Locked Memory Write 

I/O Read (or coprocessor read) 

I/O Write (or coprocessor write) 

Interrupt Acknowledge (always locked) 

Halt/Shutdown 

When the Cx486SLC/e microprocessor has no 
pending bus requests, the bus enters the idle 
state. There is no encoding of the idle state on the 
bus cycle definition signals, however, the idle 
state can be identified by the absence of further 
assertions of ADS# following a completed bus 
cycle. 



3.3.2.1 Bus Cycles using Non- 
Pipelined Addressing 

Non-Pipelined Bus States 

The shortest time unit of bus activity is a bus state, 
commonly called T states. A bus state is one 
internal processor clock period (two CLK2 
periods) in duration. A complete data transfer 
occurs during a bus cycle, composed of two or 
more bus states. 
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The first state of a non-pipelined bus cycle is called 
Tl. During phase one (first CLK2) of Tl, the 
address bus and bus cycle definition signals are 
driven valid and, to signal their availability, 
address strobe (ADS#) is simultaneously asserted. 
The second bus state of a non-pipelined cycle is 
called T2. T2 terminates a bus cycle with the 
assertion of the READY# input and valid data is 



either input or output depending on the bus cycle 
type. The fastest Cx486SLC/e microprocessor bus 
cycle requires only these two bus states. READY# 
is ignored at the end of the Tl state. 

Three consecutive bus read cycles, each consisting 
of two bus states, are shown in Figure 3-4. 
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Note: Fastest non-pipelined bus cycles consist of Tl and T2. 
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Figure 3-4. Fastest Non-Pipelined Read Cycles 
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Non-Pipelined Read and Write Cycles 

Any bus cycle may be performed with non- 
pipelined address timing. Figure 3-5 shows a 
mixture of read and write cycles with non- 
pipelined address timing. When a read cycle is 
performed, the Cx486SLC/e microprocessor floats 
its data bus and the externally addressed device 
then drives the data. The Cx486SLC/e micropro- 
cessor requires that all data bus pins be driven to 
a valid' logic state (high or low) at the end of each 
read cycle, when READY# is asserted. When a 



read cycle is acknowledged by READY# asserted 
in the T2 bus state, the Cx486SLC/e CPU latches 
the information present at its data pins and 
terminates the cycle. 

When a write cycle is performed, the data bus is 
driven by the Cx486SLC/e CPU beginning in 
phase two of Tl. When a write cycle is acknowl- 
edged, the Cx486SLC/e write data remains valid 
throughout phase one of the next bus state to 
provide write data hold time. 
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Figure 3-5* Various Non-Pipelined Bus Cycles (no wait states) 
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Non-Pipelined Wait States 

Once a bus cycle begins, it continues until ac- 
knowledged by the external system hardware 
using the READY# input. Acknowledging the bus 
cycle at the end of the first T2 results in the 
shortest possible bus cycle, requiring only Tl and 
T2. If READY# is not immediately asserted 
however, T2 states are repeated indefinitely until 
the READY# input is sampled active. These 
intermediate T2 states are referred to as wait 
states. If the external system hardware is not able 
to receive or deliver data in two bus states, it 



withholds the READY# signal and at least one 
wait state is added to the bus cycle. Thus, on an 
address by address basis the system is able to 
define how fast a bus cycle completes. 

Figure 3-6 illustrates non-pipelined bus cycles 
with one wait state added to cycles 2 and 3. 
READY# is sampled inactive at the end of the first 
T2 state in cycles 2 and 3. Therefore, the T2 state 
is repeated until READY# is sampled active at the 
end of the second T2 and the cycle is then termi- 
nated. The Cx486SLC/e ignores the READY# 
input at the end of the Tl state. 
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Figure 3-6. 
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Initiating and Maintaining Non-Pipelined 
Cycles 

The bus states and transitions for non-pipelined 
addressing are illustrated in Figure 3-7. The bus 
transitions between four possible states:' Tl, T2, 
Ti, and Th. Active bus cycles consist of Tl and 
T2 states, with T2 being repeated for wait states. 
Bus cycles always begin with a single Tl state. 
Tl is always followed by a T2 state. If a bus cycle 
is not acknowledged during a given T2 and NA# is 
inactive, T2 is repeated resulting in a wait state. 
When a cycle is acknowledged during T2, the 
following state is Tl of the next bus cycle if a bus 
request is pending internally. If no internal bus 
request is pending, the Ti state is entered. If the 
HOLD input is asserted and the Cx486SLC/e is 
ready to enter the hold acknowledge state, the 
Th state is entered. 

Due to the demultiplexed nature of the bus, the 
address pipelining option provides a mechanism 
for the external hardware to have an additional 
T state worth of access time without inserting a 
wait state. After the reset sequence and following 
any idle bus state, the processor always uses non- 
pipelined address timing. Pipelined or non- 
pipelined address timing is then determined on 
a cycle-by-cycle basis using the NA# input. 
When address pipelining is not used, the address 
and bus cycle definition remain valid during all 
wait states. When wait states are added and it is 
desirable to maintain non-pipelined address 
timing, it is necessary to negate NA# during each 
T2 state of the bus cycle except the last one. 



3.3.2.2 Bus Cycles using 

Pipelined Addressing 

The address pipelining option allows the system to 
request the address and bus cycle definition of the 
next internally pending bus cycle before the 
current bus cycle is acknowledged with READY# 
asserted. If address pipelining is used, the exter- 
nal system hardware has an extra T state of access 
time to transfer data. The address pipelining 
option is controlled on a cycle-by-cycle basis by 
the state of the NA# input. 

Pipelined Bus States 

Pipelined addressing is always initiated by assert- 
ing NA# during a non-pipelined bus cycle. 
Within the non-pipelined bus cycle, NA# is 
sampled at the beginning of phase 2 of each T2 
state and is only acknowledged by the 
Cx486SLC/e during wait states. When address 
pipelining is acknowledged, the address (BHE#, 
BLE#, and A23-A1) and bus cycle definition 
(W/R#, D/C#, and M/IO#) of the next bus cycle 
are driven before the end of the non-pipelined 
cycle. The address strobe output (ADS#) is 
asserted simultaneously to indicate validity of the 
above signals. Once in effect, address pipelining is 
maintained in successive bus cycles by continuing 
to assert NA# during the pipelined bus cycles. 

As in non-pipelined bus cycles, the fastest bus 
cycles using pipelined address require only two 
bus states. Figure 3-8 illustrates the fastest read 
cycles using pipelined address timing. The two 
bus states for pipelined addressing are TIP and 
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T2P or TIP and T2L The TIP state is entered 
following completion of the bus cycle in which 
the pipelined address and bus cycle definition 
information was made available and is the first 
bus state of every pipelined bus cycle. 



cycle definition for the next pending bus request is 
made available. If no pending bus request exists, 
the TIP state is followed by a T2I state regardless 
of the state of NA# and no new address or bus 
cycle information is driven. 



Within the pipelined bus cycle, NA# is sampled at 
the beginning of phase 2 of the TIP state. If the 
Cx486SLC/e has an internally pending bus 
request and NA# is asserted, the TIP state is 
followed by a T2P state and the address and bus 



The pipelined bus cycle is terminated in either the 
T2P or T21 state with the assertion of the 
READY# input and valid data is either input or 
output depending on the bus cycle type. 
READY# is ignored at the end of the TIP state. 



HOLD Asserted 




HOLD Negated 
No Request 



READY# Negated « 
NA# Negated 



Bus States: 

Tl ~ First clock of a non-pipelined bus cycle (CPU drives new address and asserts ADS#). 

T2 ~ Subsequent clocks of a bus cycle when NA# has not been sampled asserted in the current bus cycle. 

Ti-- Idle State. 

Th -- Hold Acknowledge (CPU asserts HLDA). 

The fastest bus cycle consists of two states: Tl and T2. 



Figure 3-7. Non-Pipelined Bus States 
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Note: Fastest pipelined bus cycles consist of TIP and T2P. 



Figure 3-8. Fastest Pipelined Read Cycles 



Pipelined Read and Write Cycles 

Any bus cycle may be performed with pipelined 
address timing. When a read cycle is performed, 
the Cx486SLC/e CPU floats its data bus and the 
externally addressed device then drives the data. 
When a read cycle is acknowledged by READY# 
asserted in either the T2P or T2I bus state, the 
CPU latches the information present at its data 
pins and terminates the cycle. 

When a write cycle is performed, the data bus is 
driven by the CPU beginning in phase two of TIP. 
When a write cycle is acknowledged, the CPU 
write data remains valid throughout phase one of 
the next bus state to provide write data hold time. 



Wait States for Pipelined Cycles 

Once a pipelined bus cycle begins, it continues 
until acknowledged by the external system 
hardware using the Cx486SLC/e READY# input. 
Acknowledging the bus cycle at the end of the 
first T2P or T2I state results in the shortest 
possible pipelined bus cycle. If READY# is not 
immediately asserted, however, T2P or T2I states 
are repeated indefinitely until the READY# input 
is sampled active. Additional T2P or T2I states are 
referred to as wait states. 

Figure 3-9 illustrates pipelined bus cycles with one 
wait state added to cycles 1 through 3. Cycle 1 is 
a pipelined cycle with NA# asserted during TIP 
and a pending bus request. READY# is sampled 
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inactive at the end of the first T2P state in cycle 1. 
Therefore, the T2P state is repeated until READY# 
is sampled active at the end of the second T2P and 
the cycle is then terminated. The Cx486SLC/e 
ignores the READY# input at the end of the TIP 
state. Note that ADS#, the address and the bus 
cycle definition signals for the pending bus cycle 
are all valid during each of the T2P states. Also, 
asserting NA# more than once during the cycle 
has no additional effects. Pipelined addressing can 
only output information for the very next bus 
cycle. 

Cycle 2 in Figure 3-9 illustrates a pipelined cycle, 
with one wait state, where NA# is not asserted 
until the second bus state in the cycle. In this case, 
the CPU enters the T2 state following TIP because 
NA# is not asserted. During the T2 state, the 
Cx486SLC/e samples NA# asserted. Because a bus 
request is pending internally and READY# is not 
active, the CPU enters the T2P state and asserts 
ADS#, valid address and bus cycle definition 
information for the pending bus cycle. The cycle 



is then terminated by an active READY# at the 
end of the T2P state. 

Cycle 3 of Figure 3-9 illustrates the case where no 
internal bus request exists until the last state of a 
pipelined cycle with wait states. In cycle 3, NA# 
is asserted in TIP requesting the next address. 
Because the CPU does not have an internal bus 
request pending, the T2I state is entered. How- 
ever, by the end of the T2I state, a bus request 
exists. Because READY# is not asserted, a wait 
state is added. The CPU then enters the T2P state 
and asserts ADS#, valid address and bus cycle 
definition information for the pending bus cycle. 
As long as the CPU enters the T2P state at some 
point during the bus cycle, pipelined addressing 
is maintained. NA# need only be asserted once 
during the bus cycle to request pipelined addressing. 
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as the CPU has another 
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after NA# is asserted. 



Asserting NA# more than 
once during any cycle 
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As long as the CPU enters the T2P 
state during Cycle 3, address pipelining 
is maintained in Cycle 4. 



NA# could have been asserted in 
TIP if desired. Assertion now is 
the latest time possible to allow 
the CPU to enter T2P state to 
maintain pipelining in Cycle 3. 
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Figure 3-9. Various Pipelined Cycles (one wait state) 
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Initiating and Maintaining Pipelined Cycles 

Pipelined addressing is always initiated by assert- 
ing NA# during a non-pipelined bus cycle with at 
least one wait state. The first bus cycle following 
RESET, an idle bus or a hold acknowledge state is 
always non-pipelined. Therefore, the Cx486SLC/e 
always issues at least one non-pipelined bus cycle 
following RESET, idle or hold acknowledge 
before pipelined addressing takes effect. 

Once a bus cycle is in progress and the current 
address has been valid for one entire bus state, the 
NA# input is sampled at the end of every phase 
one until the bus cycle is acknowledged. Once 



NA# is sampled active, the Cx486SLC/e micro- 
processor is free to drive a new address and bus 
cycle definition on the bus as early as the next bus 
state and as late as the last bus state in the cycle. 

Figure 3-10 illustrates the fastest transition 
possible to pipelined addressing following an idle 
bus state. In Cycle 1, the next address is driven 
during state T2P. Thus, Cycle 1 makes the 
transition to pipelined address timing, since it 
begins with Tl but ends with T2P. Because the 
address for Cycle 2 is available before Cycle 2 
begins, Cycle 2 is called a pipelined bus cycle and 
it begins with a TIP state. Cycle 2 begins as soon 
as READY# asserted terminates Cycle 1. 



A23-A1, r 
BHE#,BLE#, 
M/IO#,D/C# L 




Note: Following any idle bus state (Ti), the address is always non-pipelined and NA# is sampled only 
during wait state. To start address pipelining after an idle state requires a non-pipelined cycle 
with at least one wait state (Cycle 1 above). The pipelined cycles (2, 3, and 4 above) are shown 
with 0, and 1 wait states respectively. 



Figure 3- 1 0. Fastest Transition to Pipelined Address Following Idle Bus State 
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Figure 3-11 illustrates transitioning to pipelined 
addressing during a burst of bus cycles. Cycle 2 
makes the transition to pipelined addressing. 
Comparing Cycle 2 to Cycle 1 of Figure 3-10 
illustrates that a transition cycle is the same 
whenever it occurs consisting of at least Tl, T2 
(NA# is asserted at that time), and T2P (provided 



the Cx486SLC/e microprocessor has an internal 
bus request already pending). T2P states are 
repeated if wait states are added to the cycle. 
Cycles 2,3, and 4 in Figure 3-11 show that once 
address pipelining is achieved it can be main- 
tained with two-state bus cycles consisting only of 
TIP and T2P. 
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Note: Following any idle bus state (Ti), the address is non-pipelined . Within non- 
pipelined bus cycles, NA# is sampled only during wait states. Therefore, to begin 
address pipelining during a group of non-pipelined bus cycles requires a non- 
pipelined cycle with at least one wait state (Cycle 2 above). 



Figure 3-11. Transitioning to Pipelined Address During Burst of Bus Cycles 
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Once a pipelined bus cycle is in progress, pipe- 
lined timing is maintained for the next cycle by 
asserting NA# and detecting that the Cx486SLC/e 
microprocessor enters T2P during the current bus 
cycle. The current bus cycle must end in state 
T2P for pipelining to be maintained in the next 
cycle. T2P is identified by the assertion of ADS#. 
Figures 3-10 and 3-11 each show pipelining 
ending after Cycle 4. This occurred because the 



Cx486SLC/e CPU did not have an internal bus 
request prior to the acknowledgment of Cycle 4. 

The complete bus state transition diagram, including 
operation with pipelined address is given in 
Figure 3-12. This is a superset of the diagram for 
non-pipelined address. The three additional bus 
states for pipelined address are shaded. 
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Figure 3- 1 2. Complete Bus States 
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3.3.3 Locked Bus Cycles 

When the LOCK# signal is asserted, the 
Cx486SLC/e microprocessor does not allow other 
bus master devices to gain control of the system 
bus. LOCK# is driven active in response to 
executing certain instructions with the LOCK 
prefix. The LOCK prefix allows indivisible 
read/modify/write operations on memory oper- 
ands. LOCK# is also active during Interrupt 
Acknowledge Cycles. 

LOCK# is activated on the CLK2 edge that begins 
the first locked bus cycle and is deactivated when 
READY# is returned at the end of the last locked 
bus cycle. When using non-pipelined addressing, 
LOCK# is asserted during phase 1 of Tl. When 
using pipelined addressing, LOCK# is driven 
valid during phase 1 of TIP. 

Figures 3-4 through 3-6 illustrate LOCK# timing 
during non-pipelined cycles and Figures 3-8 
through 3-11 cover the pipelined address case. 



3.3.4 Interrupt Acknowledge 
(INTA) Cycles 

The Cx486SLC/e microprocessor is interrupted 
by an external source via an input request on the 
INTR input (when interrupts are enabled). The 
Cx486SLC/e microprocessor responds with two 
locked interrupt acknowledge cycles. These bus 
cycles are similar to read cycles. Each cycle is 
terminated by READY# sampled active as shown 
in Figure 3-13. 

The state of A2 distinguishes the first and second 
interrupt acknowledge cycles. The address driven 
during the first interrupt acknowledge cycle is 4h 
(A23-A3, Al, BLE# = 0; A2, BHE# = 1). The 
address driven during the second interrupt 
acknowledge cycle is Oh (A23-A1, BLE# = and 
BHE#= 1). 

To assure that the interrupt acknowledge cycles 
are executed indivisibly, the LOCK# output is 
asserted from the beginning of the first interrupt 
acknowledge cycle until the end of the second 
interrupt acknowledge cycle. Four idle bus states 
(Ti) are always inserted by the Cx486SLC/e 
microprocessor between the two interrupt ac- 
knowledge cycles. 

The interrupt vector is read at the end of the 
second interrupt cycle. The vector is read by the 
Cx486SLC/e microprocessor from D7-D0 of the 
data bus. The vector indicates the specific inter- 
rupt number (from 0-255) requiring service. 
Throughout the balance of the two interrupt 
cycles D15-D0 float. At the end of the first inter- 
rupt acknowledge cycle, any data presented to the 
Cx486SLC/e is ignored. 
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Acknowledge bus cycle. Because each Intrrupt Acknowledge busy cycle is followed by 
idle bus states, asserting NA# has no practical effect. 



Figure 3-13. Interrupt Acknowledge Cycles 
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3.3.5 Halt and Shutdown 
Cycles 

Halt Indication Cycle 

Executing the HLT instruction causes the 
Cx486SLC/e execution unit to cease operation. 
Signaling its entrance into the halt state, a halt 
indication cycle is performed. The halt indication 



cycle is identified by the state of the bus cycle 
definition signals (M/IO#=l, D/C#=0, W/R#=l, 
LOCK#=l) and an address of 2h (A23-A2=0, 
Al=l, BHE#=1, BLE#=0). The halt indication 
cycle must be acknowledged by READY# as- 
serted. A halted Cx486SLC/e microprocessor 
resumes execution when INTR (if interrupts are 
enabled), NMI, or RESET is asserted. Figure 3-14 
illustrates a non-pipelined halt cycle. 
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Figure 3-14. Non-pipelined Halt Cycle 
PRELIMINARY 



Functional Timing 



3 



Shutdown Indication Cycle 

Shutdown occurs when a severe error is detected 
that prevents further processing. Signaling its 
entrance into the shutdown state, the CPU issues 
a shutdown indication cycle. The shutdown 
indication cycle is identified by the state of the 
bus cycle definition signals (M/IO#=l, D/C#=0, 



W/R#=l, LOCK=l) and an address of Oh (A23- 
Al = 0, BHE# = 1, BLE#=0)i The shutdown 
indication cycle must be acknowledged by 
READY# asserted. A shut down Cx486SLC/e 
microprocessor resumes execution only when 
NM1 or RESET is asserted. Figure 3-15 illustrates 
a shutdown cycle using pipelined addressing. 
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Figure 3- 1 5. Pipelined Shutdown Cycle 
PRELIMINARY 



3-29 



Timing 



3.3*6 Internal Cache Interface 

3.3.6.1 Cache Fills 

Any unlocked memory read cycle can be cached 
by the Cx486SLC/e. The Cx486SLC/e automati- 
cally does not cache accesses to memory ad- 
dresses specified by the non-cacheable region 
registers. Additionally, the KEN# input can be 
used to enable caching of memory accesses on a 
cycle-by-cycle basis. The Cx486SLC/e acknowl- 
edges the KEN# input only if the KEN enable bit 
is set in the CCRO configuration register. 

As shown in Figures 3-16 and 3-17, the 
Cx486SLC/e samples the KEN# input one CLK2 
before READY# is sampled active. If KEN# is 
asserted and the current address is not set as non- 
cacheable per the non-cacheable region registers, 
then the Cx486SLC/e fills two bytes of a line in 
the cache with the data present on the data bus 
pins. The states of BHE# and BLE# are ignored if 
KEN# is asserted for the cycle. 



If the RPL bit in the CCR1 configuration register 
is set, then the RPLSET and RPLVAL# output 
signals are driven by the Cx486SLC/e during 
cache fill cycles. If the cache is configured as 
direct-mapped (CO bit in CCRO configuration 
register), RPLSET is always driven low; If the 
cache is configured as two-way set associative, 
RPLSET indicates which set in the cache is 
undergoing a line replacement. RPLVAL# indi- 
cates that the Cx486SLC/e will perform a cache 
fill to the indicated set with the data present on 
the data bus pins at the time READY# is sampled 
active. However, if KEN# is enabled and sampled 
inactive, the data is not cached and the line in the 
set indicated by RPLSET is not overwritten. 

Figures 3-16 and 3-17 illustrate RPLVAL# and 
RPLSET functional timing for both non-pipelined 
and pipelined cache fills. RPLVAL# is driven at 
the same time and for the same duration as the 
ADS# output for the cache fill cycle. RPLSET is 
driven one CLK2 after RPLVAL# is driven regard- 
less of whether or not the current bus cycle is 
pipelined. 




3-30 



PRELIMINARY 



Functional Timing 



3 



Cycle 1 
Non-Pipelined 
(Read - Cache Fill) 
Tl T2 
01 I 02 01 02 



Cycle 2 
Non-Pipelined 
(Read - Cache Fill) 
Tl T2 T2 

01 I 02 01 I 02 01 I 02 




READY* [ 
LOCK# [ 



NA# £ 

— r xjxxxx i x 



Valid 1 



D15-D0 



LZS> < 



X 



xxxxxxxx x 



Valid 2 



xxxx 



xxxx 



-<taT> 



Figure 3-16. Non-Pipelined Cache Fills using KEN# 
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Figure 3-1 7. Pipelined Cache Fills using KEN# 



3.3.6.2 Flushing the Cache 

To maintain cache coherency with external 
memory, the Cx486SLC/e cache contents should 
be invalidated when previously cached data is 
modified in external memory by another bus 
master. The Cx486SLC/e invalidates the internal 
cache contents during execution of the INVD and 
WBINVD instructions, following assertion of 
HLDA if the BARB bit is set in the CCRO configu- 
ration register, or following assertion of FLUSH# 
if the FLUSH bit is set in CCRO. 



The Cx486SLC/e samples the FLUSH# input on 
the rising edge of CLK2 corresponding to the begin- 
ning of phase 2 of the internal processor clock. If 
FLUSH# is asserted, the Cx486SLC7e invalidates the 
entire contents of the internal cache. The actual 
point in time where the cache is invalidated depends 
upon the internal state of the execution pipeline. 
FLUSH# must be asserted for at least two CLK2 
periods and must meet specified setup and hold 
times to be recognized on a specific CLK2 edge. 



3-32 



PRELIMINARY 



Functional Timing 



3 



3.3.7 Address Bit 20 Masking 

The Cx486SLC/e can be forced to provide 8086 
1 -MByte address wrap-around compatiblity by 
setting the A20 bit in the CCRO configuration 
register and asserting the A20M# input. When 
the A20M# input is asserted, the 20th bit in the 
address to both the internal cache and the exter- 
nal bus pin is masked (zeroed). 

As shown in Figure 3-18 , the Cx486SLC/e 
samples the A20M# input on the rising edge of 
CLK2 corresponding to the beginning of phase 2 



of the internal processor clock. If A20M# is 
asserted and paging is not enabled, the 
Cx486SLC/e masks the A20 signal internally 
starting with the next cache access and externally 
starting with the next bus cycle. 

If paging is enabled, the A20 signal is not masked 
regardless of the state of A20M#. A20 remains 
masked until the access following detection of an 
inactive state on the A20M# pin. A20M# must be 
asserted for a minimum of two CLK2 periods and 
must meet specified setup and hold times to be 
recognized on a specific CLK2 edge. 
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Figure 3-18. Masking A20 using A20M# During Burst of Bus Cycles 
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An alternative to using the A20M# pin is provided 
by the NCO bit in the CCRO cache control con- 
figuration register. The Cx486SLC/e automati- 
cally does not cache accesses, to the first 64 KBytes 
and to the first 64 KBytes at each 1 -MByte bound- 
ary, if the NCO bit is set. This prevents data 
within the wrap-around memory area from 
residing in the internal cache and thus eliminates 
the need for masking A20 to the internal cache. 

3.3.8 Hold Acknowledge State 

The hold acknowledge state provides the mecha- 
nism for an external device in a Cx486SLC/e 
system to acquire the Cx486SLC/e system bus 
while the Cx486SLC/e is held in an inactive bus 
state. This allows external "bus masters" to take 
control of the Cx486SLC/e bus and directly access 
system hardware in a shared manner with 
the Cx486SLC/e. The Cx486SLC/e continues to 
execute instructions out of the cache (if enabled) 
until a system bus cycle is required. 

The hold acknowledge state (Th) is entered in 
response to assertion of the HOLD input. In the 
hold acknowledge state, the Cx486SLC/e micro- 
processor floats all output and bi-directional 
signals, except for HLDA and SUSPA#. HLDA is 
asserted as long as the Cx486SLC/e CPU remains 
in the hold acknowledge state and all inputs except 
HOLD, FLUSH#, FLT#, SUSP# and RESET are 
ignored. 



Th may be entered directly from a bus idle state, 
as in Figure 3-19, or after the completion of the 
current physical bus cycle if the LOCK# signal is 
not asserted, as in Figures 3-20 and 3-21. The 
CPU samples the HOLD input on the rising edge 
of CLK2 conesponding to the beginning of phase 1 
of the internal processor clock. HOLD must meet 
specified setup and hold times to be recognized at 
a given CLK2 edge. 

The hold acknowledge state is exited in response 
to the HOLD input being negated. The next bus 
state is an idle state (Ti) if no bus request is 
pending, as in Figure 3-19. If a bus request is 
internally pending, as in Figures 3-20 and 3-21, 
the next bus state is Tl . Th is also exited in 
response to RESET being asserted. If HOLD 
remains asserted when RESET goes inactive, the 
Cx486SLC/e enters the hold acknowledge state 
before performing any bus cycles provided HOLD 
is still asserted when the CPU is ready to perform 
its first bus cycle. 

If a rising edge occurs on the edge-triggered NMI 
input while in the Th state, the event is remem- 
bered as a non-maskable interrupt 2 and is 
serviced when the Th state is exited. 
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Figure 3- 1 9. Requesting Hold from Idle Bus State 
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Figure 3-20. Requesting Hold from Active Non-Pipelined Bus 
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Figure 3-2 1 • Requesting Hold from Active Pipelined Bus 
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3.3.9 Coprocessor Interface 3.3.10 SMM Interface 



The coprocessor interface consists of the data bus, 
address bus, bus cycle definition signals, and the 
coprocessor interface signals (BUSY#, ERROR# 
and PEREQ). The Cx486SLC/e automatically 
accesses dedicated coprocessor I/O addresses 
80 00F8h, 80 OOFCh and 80 OOFEh to transfer 
opcodes and operands to/from the coprocessor 
whenever a coprocessor instruction is decoded. 
Coprocessor cycles can be either read or write and 
can be either non-pipelined or pipelined. Copro- 
cessor cycles must be terminated by READY# . 
and, as with any other bus cycle, can be termi- 
nated as early as the second bus state of the cycle. 

BUSY#, ERROR# and PEREQ are asynchronous 
level-sensitive inputs used to synchronize CPU 
and coprocessor operation. All three signals are 
sampled at the beginning of phase 1 and must 
meet specified setup and hold times to be recog- 
nized at a given CLK2 edge. 



System Management Mode (SMM) uses two 
Cx486SLC/e pins, SMI# and SMADS#. The bi- 
directional SMI# pin is a non-maskable interrupt 
that is higher priority than the NMI input. SMI# 
must be active for at least four CLK2 periods to be 
recognized by the Cx486SLC/e. Once the 
Cx486SLC/e recognizes the active SMI# input, the 
CPU drives the SMI# pin low for the duration of 
the SMI service routine. 

The SMADS# pin outputs the SMM Address 
Strobe which indicates that a SMM memory bus 
cycle is in progress and a valid SMM address is on 
the address bus. The SMADS# functional timing, 
output delay times and float delay times are 
identical to the main memory address strobe 
(ADS#) timing. 
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SMI Handshake 

The functional timing for SMI# interrupt is 
shown in Figure 3-22. Five significant events 
take place during a Cx486SLC/e SM1# handshake: 

(a) The SMI# input pin is driven active 
(low) by the system logic. 

(b) The CPU samples SMI# active on the 
rising edge of CLK2 phase 1. 

(c) Four CLK2s after sampling the SMI# 
active, the CPU switches the SM1# pin 
to an output and drives SM1# low. 



(d) Following execution of the RSM 
instruction the CPU drives the SM1# 
pin high for two CLK2s indicating 
completion of the SMI service routine. 

(e) The CPU stops driving the SMI# pin 
high and switches the SMI# pin to an 
input in preparation for the next SMI 
interrupt. The system logic is respon- 
sible for maintaining the SMI# pin at 
an inactive (high) level after the pin has 
been changed to an input. 
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Figure 3-22. SMI# Timing 
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I/O Trapping 

The Cx486SLC/e provides I/O trapping which can 
be used to facilitate power management of I/O 
peripherals. When an I/O bus cycle is issued, 
the I/O address is driven onto the address bus 
and can be decoded by external logic. If a trap to 
the SMI handler is required, the SMI# input 
should be activated at least three CLK2 edges prior 



to returning the READY# input for the I/O cycle. 
The timing for creating an I/O trap via the SMI# 
input is shown in Figure 3-23. The Cx486SLG/e 
immediately traps to the SMI interrupt handler 
following execution of the I/O instruction, and no 
other instructions are executed between comple- 
tion of the I/O instruction and entering the SMI 
service routine. The I/O trap mechanism is not 
active during coprocessor accesses. 
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Figure 3-23. I/O Trap Timing 
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3.3.1 1 Power Management 

SUSP# Initiated Suspend Mode 

The Cx486SLC/e enters suspend mode when the 
SUSP# input is asserted and execution of the 
current instruction, any pending decoded instruc- 
tions and associated bus cycles are completed. 
The Cx486SLC/e CPU also waits for the copro- 
cessor not busy (BUSY# negated) prior to entering 
suspend mode (Figure 3-24). The SUSPA# 
output is asserted. The Cx486SLC/e responds to 
SUSP# and asserts SUSPA# only if the SUSP bit is 
set in the CCRO configuration register. 

SUSP# is sampled on the rising edge of phase 2 
CLK2. SUSP# must meet specified setup and 
hold times to be recognized at a particular CLK2 
edge. The time from assertion of SUSP# to 
activation of SUSPA# varies depending on which 



instructions were decoded prior to assertion of 
SUSP#. The minimum time from SUSP# 
sampled active to SUSPA# asserted is two CLK2s. 
As a maximum, the CPU may execute up to two 
instructions and associated bus cycles prior to 
asserting SUSPA#. The time required for the CPU 
to deactivate SUSPA# once SUSP# has been 
sampled inactive is four CLK2s. 

If the CPU is in a hold acknowledge state and SUSP# 
is asserted, the CPU may or may not enter suspend 
mode depending on the state of the CPU internal 
execution pipeline. If the CPU is in a SUSP# initiated 
suspend state and the CLK2 input is not stopped, the 
processor recognizes and acknowledges the HOLD 
input and stores the occurrence of FLUSH#, NMI, 
SMI# and INTR (if enabled) for execution once 
suspend mode is exited. 




Figure 3-24. SUSP# Initiated Suspend Mode 
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HALT Initiated Suspend Mode 

The Cx486SLC/e also enters suspend mode as a 
result of executing a HALT instruction. The 
SUSPA# output is asserted no more than 17 
CLK2s following READY# sampled active for the 
HALT bus cycle as shown in Figure 3-25. Suspend 
mode is then exited upon recognition of an NMI 



or an unmasked INTR. SUSPA# is deactivated 12 
CLK2s after sampling of an active NMI or un- 
masked INTR. If the Cx486SLC/e is in a HALT 
initiated suspend mode and the CLK2 input is not 
stopped, the processor recognizes and acknowl- 
edges the HOLD input and stores the occurrence 
of FLUSH# for execution once suspend mode is 
exited. 
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Figure 3-25. Halt Initiated Suspend Mode 
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Stopping the Input Clock 

Because the Cx486SLC/e is a static device, the 
input clock (CLK2) can be stopped and restarted 
without loss of any internal CPU data. CLK2 can 
be stopped in either phase 1 or phase 2 of the clock 
and either in a logic high or logic low state. 
However, entering suspend mode prior to stop- 
ping CLK2 dramatically reduces the CPU current 
requirements. Therefore, the recommended 
sequence for stopping CLK2 is to initiate 
Cx486SLC/e suspend mode, wait for assertion of 
SUSPA# by the processor and then stop the input 
clock. 



The Cx486SLC/e remains suspended until CLK2 is 
restarted and suspend mode is exited as described 
earlier. While CLK2 is stopped, the Cx486SLC/e 
can no longer sample and respond to any input 
stimulus including the HOLD, FLUSH#, NMI, 
INTR and RESET inputs. 

Figure 3-26 illustrates the recommended 
sequence for stopping CLK2 using SUSP# to 
initiate suspend mode. CLK2 may be started 
prior to or following negation of the SUSP# input. 



01 I 02 




01 | 02 



01 | 02 




SUSPA# 



Figure 3-26. Slopping CLK2 During Suspend Mode 
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3.3.11 Float 

Activating the FLT# input floats all 
Cx486SLC/e microprocessor bi-directional and 
output signals. Asserting FLT# electrically 
isolates the Cx486SLC/e microprocessor from 
the surrounding circuitry. This feature is useful 
in board-level test environments. As the 
Cx486SLC/e microprocessor is packaged in a 
surface mount PQFP, it is not usually socketed and 
cannot be removed from the motherboard when 
In-Circuit Emulation (ICE) is needed. Float 
capability allows connection of an emulator by 
clamping the emulator probe onto the 
Cx486SLC/e microprocessor PQFP without 
removing it from the circuit board. 

FLT# is an asynchronous, active low input. It is 
recognized on the rising edge of CLK2. When 



recognized, it aborts the current bus state and 
floats the outputs of the Cx486SLC/e micropro- 
cessor as shown in Figure 3-27. FLT# must be 
asserted for a minimum of 16 CLK2 cycles. To 
exit the float condition, RESET should be asserted 
and held asserted until after FLT# is deasserted. 

Asserting the FLT# input unconditionally aborts 
the current bus cycle and forces the Cx486SLC/e 
microprocessor into the float mode. As a result, 
the Cx486SLC/e microprocessor is not guaranteed 
to enter float in a valid state. After deactivating 
FLT#, the Cx486SLC/e CPU is not guaranteed to 
exit float in a valid state. The Cx486SLC/e 
microprocessor RESET input must be asserted 
prior to exiting float to guarantee that the 
Cx486SLC/e is reset and that it returns to a valid 
state. 



CLK2 



FLT# 



Control 



Data 



Address 



[ /WWWWWWVWWWWY 



[ 



f 



[IT 



Valid 



-t 



[ -o-c 



Valid 



[ 



Valid 



Figure 3-27. Entering and Exiting Float 
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4. ELECTRICAL SPECIFICATIONS 

4.1 Electrical Connections 

4.1.1 Power and Ground Con- 
nections and Decoupling 

Due to the high frequency of operation of the 
Cx486SLC/e, it is necessary to install and test this 
device using standard high frequency techniques. 
The high clock frequencies used in the 
Cx486SLC/e and its output buffer circuits can 
cause transient power surges when several output 
buffers switch output levels simultaneously. 
These effects can be minimized by filtering the 
DC power leads with low-inductance decoupling 
capacitors, using low impedance wiring, and by 
utilizing all of the 14 V cc and 18 GND pins. 

4. 1 .2 Pull-Up/Pull-Down 
Resistors 

Table 4-1 lists the input pins which are internally 
connected to pull-up and pull-down resistors. 
The pull-up resistors are connected to V cc and the 
pull-down resistors are connected to V ss . When 
unused, these inputs do not require connection to 
external pull-up or pull-down resistors. 



Table 4-1 • Pins Connected to 
Internal Pull-Up and Pull-Down Resistors 



SIGNAL 


PIN 


RESISTOR 


A20M# 


31 


20-kQ pull-up 


BUSY# 


34 


20-kQ pull-up 


ERROR# 


36 


20-kQ pull-up 


FLT# 


28 


20-kQ pull-up 


FLUSH# 


30 


20-kQ pull-up 


KEN# 


29 


20-kQ pull-up 


PEREQ 


37 


20-kQ pull-down 


SMI# 


47 


20-kQ pull-up 


SUSP# 


43 


20-kQ pull-up 



It is recommended that the ADS# and LOCK# 
output pins be connected to pull-up resistors, as 
indicated in Table 4-2. The external pull-ups 
guarantee that the signals will remain negated 
during hold acknowledge states. 



Table 4-2. Pins Requiring 
External Pull-Up Resistors 



SIGNAL 


PIN 


EXTERNAL RESISTOR 


ADS# 
LOCK# 


16 
26 


20-kQ pull-up 
20-kQ pull-up 



PRELIMINARY 



4-1 




Absolute Maximum Ratings 



4. 1.3 Unused Input Pins 

All inputs not used by the system designer and 
not listed in Table 4-1 should be connected either 
to ground or to V cc Connect active-high inputs 
to ground through a 20 k£2 (± 10%) pull-down 
resistor and active-low inputs to V cc through a 
20 k£2 (± 10%) pull-up resistor to prevent pos- 
sible spurious operation. 



4.1.4 N/C Designated Pins 

Pins designated N/C should be left disconnected. 
Connecting an N/C pin to a pull-up resistor, pull- 
down resistor, or an active signal could cause 
unexpected results and possible circuit malfunc- 
tions. 



4.2 Absolute Maximum 
Ratings 

The following table lists absolute maximum 
ratings for the Cx486SLC/e and Cx486SLC/e-V 
microprocessors. Stresses beyond those listed 
under Table 4-3 limits may cause permanent 
damage to the device. These are stress ratings only 
and do not imply that operation under any 
conditions other than those listed under "Recom- 
mended Operating Conditions" (Table 4-4) is 
possible. Exposure to conditions beyond 
Table 4-3 may (1) reduce device reliability and 
(2) result in premature failure even when there is 
no immediately apparent sign of failure. Pro- 
longed exposure to conditions at or near the 
absolute maximum ratings (Table 4-3) may also 
result in reduced useful life and reliability. 



Table 4-3. Absolute Maximum Ratings 



PARAMETER 


MIN 


MAX 


UNITS 


NOTES 


Case Temperature 


-65° 


+110° 


C 


Power Applied 


Storage Temperature 


-65° 


+150° 


C 


No Bias 


Supply Voltage, V cc 


-0.5 


6.5 


V 


With Respect to V ss 


Voltage On Any Pin 


-0.5 


V cc + 0.5 


V 


With Respect to V ss 


Input Clamp Current, I 1K 




10 


mA 


Power Applied 


Output Clamp Current, 1 QK 




25 


mA 


Power Applied 
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4.3 Recommended Operating Conditions 

The following table presents the recommended operating conditions for the Cx486SLC/e and 
Cx486SLC/e-V devices. The Cx486SLC/e-V can be operated as a Cx486SLC/e. 



Table 4-4. Recommended Operating Conditions 



PARAMETER 


Cx486SLC/e 


Cx486SLC/e-V 


UNITS 


NOTES 


MIN 


MAX 


MIN 


MAX 


T c 


Case Temperature 


0° 


+100° 


0° 


+85° 


C 


Power Applied 




Supply Voltage (-20, -25) 


4.5 


5.5 


3.0 


3.6 


V 


With Respect to V ss 


V cc 


Supply Voltage (-33) 


4.75 


5.25 






V 


With Respect to V ss 


V , H 


High Level Input 


2.0 


V cc + 0.3 


2.0 


Vcc + 0.3 


V 




\ 


Low Level Input 


-0.3 


0.8 


-0.3 


0.6 


V 






CLK2 Input LOW 
Voltage 


-0.3 


0.8 


-0.3 


0.5 


V 




v 

IHC 


CLK2 Input HIGH 
Voltage 


3.7 


V cc + 0.3 


V cc - 0.5 


V cc + 0.3 


V 






Output Current 
(High) 




-1.0 




-1.0 


mA 


V =V 

OH OH(min) 




Output Current 
(Low) 




5.0 




3.0 


mA 


V =v 

OL OL(max) 




Input Clamp 
Current 




+10 




+10 


mA 


V ,N>V C C 


W 


Output Clamp 
Current 




+25 




+25 


mA 


V OUT <V SS 0r 
V 0U1 > V CC 
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Table 4-5. DC Characteristics (at Recommended Operating Conditions) 



PARAMETER 


Cx486SLC/e 


Cx486SLC/e-V 


UNITS* 


NOTES 


MIN 


MAX 


MIN 


MAX 


Vol Output Low Voltage 
Iol= 3 mA 
Iol = 5 mA 




0.45 




0.35 


V 




Voh Output High Voltage 
Ioh = -1 mA 
Ioh = -0.2 mA 


2.4 

Vcc - 0.5 




Vcc - 0.4 
Vcc - 0.4 




V 




Tt i InTnil" T pakacrp C^nTTPnf 

For all pins except for pins using 
pull up/down resistors (see manual). 




±15 




±15 


llA 


<T ViN < Vrr 

\J ^ V UN x V i^L. 


Iih Input Leakage Current 
PEREQ 




200 




200 


|UA 


Vin=2.4 
Note 1 


Iil Input Leakage Current 

A20M#, BUSY#, ERROR#, FLT#, 
FLUSH#, KEN#, SUSP# 




-400 




-400 


MA 


Vil = 0.45V 
Note 2 


Ice Active Ice 

20 MHz (CLK2 = 40 MHz) 
25 MHz (CLK2 = 50 MHz) 
33 MHz (CLK2 = 66 MHz) 


Typical: 
360 
395 
495 


450 
495 
615 


Typical: 
185 
225 


235 
285 


mA 




Iccsm Suspend Mode Ice 

20 MHz (CLK2 = 40 MHz) 
25 MHz (CLK2 = 50 MHz) 
33 MHz (CLK2 = 66 MHz) 


Typical: 
8.0 
9.0 
10.0 


14.0 
15.0 
18.0 


Typical 
5.0 
6.0 


9.0 
10.0 


mA 


Note 3 
Note 3 
Note 3 


Iccss Standby Ice 

MHz (Suspended/CLK2 Stopped) 


Typical: 
0.4 


2 


Typical: 
0.3 


• 2 


mA 


Note 3 


Cin Input Capacitance 




10 




10 


pF 


fc=lMHz (Note 4) 


Cout Output or I/O Capacitance 




12 




12 


pF 


fc=lMHz (Note 4) 


Cclk CLK2 Capacitance 




20 




20 


pF 


fc= 1MHz (Note 4) 



Notes: 1. PEREQ input has an internal pull-down resistor. 

2. A20M#, BUSY#, ERROR#, FLT#, FLUSH#, KEN#, and SUSP# inputs each have an internal pull-up resistor. 

3. All inputs at 0.4 or V cc -0.4 (CMOS levels). All inputs held static (except CLK2 as indicated). All outputs unloaded (static I 0UT = mA). 

4. Not 100% tested. 
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4.5 AC Characteristics 

Tables 4-7 and 4-8 list the AC characteristics 
including output delays, input setup require- 
ments, input hold requirements and output float 
delays. These measurements are based on the 
measurement points identified in Figures 4-1 and 
4-2. The rising clock edge reference level V REFC , 
and other reference levels are shown in Table 4-6 
below for the Cx486SLC/e and Cx486SLC/e-V. 
Input or output signals must cross these levels 
during testing. 

Figure 4-1 shows output delay (A and B) and 
input setup and hold times (C and D). Input 
setup and hold times (C and D) are specified 
minimums, defining the smallest acceptable 
sampling window a synchronous input signal 
must be stable for correct operation. 



The outputs: A23-A1, ADS#, BHE#, BLE#, D/C#, 
HLDA, LOCK#, M/IO#, RPLVAL#, SMAD#, 
SMI# and W/R# change only at the beginning of 
phase one (Figure 4-1). D15-D0 (write cycles), 
RPLSET and SUSPA# change at the beginning of 
phase two. 

The inputs: BUSY#, D15-D0 (read cycles), 
ERROR#, FLT#, HOLD, PEREQ, and READY# 
are sampled at the beginning of phase one 
(Figure 4-1). A20M#, FLUSH#, INTR, KEN#, 
NA#, NMI, SM1# and SUSP# are sampled at the 
beginning of phase two. 



Table 4-6. Measurement Points for Switching Characteristics 



SYMBOL 


Cx486SLC/e 


Cx486SLC/e-V 


UNITS 


V 

REFC 


2 


1.5 


V 




1.5 


1.2 


V 


v 

IHC 


V cc - 0.8 


V cc -0.5 


V 


V ,c 


0.8 


0.6 


V 


V 

IHD 


3 


2.3 


V 


v ILD 








V 
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A23-A1,ADS#, BHE#, 

BLE#, D/C, HLDA, Valid 
LOCK#,M/IO#, o 
SMADS#, SMI#, 
RPLVAL#, W/R# 



D15-D0, RPLSET, 
SUSPA# 



INPUTS: 

A20M#, FLUSH#, 
INTR, KEN#,NA#, 
NMI#, SMI# SUSP# 



INPUTS: 



BUSY#, D15-D0, 
ERROR#, FLT#, HOLD, 
PEREQ, READY# 




LEGEND: A - Maximum Output Delay Specification 
B - Minimum Output Delay Specification 
C - Minimum Input Setup Specification 
D - Minimum Input Hold Specification 



Figure 4-1 • Drive Level and Measurement Points for Switching Characteristics 



4-6 



PRELIMINARY 



AC Characteristics 



4 




PRELIMINARY 



4-7 




Table 4-7. AC Characteristics for Cx486SLC/e-V20 

Cx486SLC/e-V20: V cc = 3.0 to 3.6 V, T c = 0° to 85°C 







20 MHz 






SYMBOL 


PARAMETER 


MIN 

ins) 


MAX 

ins) 


FIGURE 


NOTES 


Tl 


CLK2 Period 


25 




4-2 


Note 1 


T2a 


CLK2 High Time 


8 




4-2 


Note 2 


T2b 


CLK2 High Time 


5 




4-2 


Note 2 


T3a 


CLK2 Low Time 


Q 
O 




4-2 


Note 2 


T3b 


CLK2 Low Time 


5 




4-2 


Note 2 


T4 


CLK2 Fall Time 




8 


4-2 


Note 2 


T5 


CLK2 Rise Time 




8 


4-2 


Note 2 


T6 


A23-A1,SM1# Valid Delay 


4 


30 


4-4, 4-7 


C L = 50 pF 


T7 


A23-A1 Float Delay 


4 


32 


4-7 


Note 3 


T8 


BHE#, BLE#, LOCK# Valid Delay 


A 
T 


DV 


4-4, 4-7 


C L = 50 pF 


T9 


BHE#, BLE#, LOCK# Float Delay 


4 


32 


4-7 


Note 3 


T10 


ADS#, D/C#, M/IO#, RPLVAL#, 
SMADS#, W/R# Valid Delay 


4 


26 


4-4, 4-7 


C = 50 pF 

L " 


Til 


ADS#, D/C#, M/IO#, RPLVAL#, 
SMADS#, W/R# Float Delay 


4 


30 


4-7 


Note 3 


T12 


D15-D0 Write Data, RPLSET, 
SUSPA# Valid Delay 


4 


38 


4-4, 4-5 


C L = 50 pF, Note 5 


T12a 


D15-D0 Write Data Hold Time 


4 




4-6 




T13 


D15-D0 Write Data, RPLSET, 
SUSPA# Float Delay 


4 


27 


4-7 


Note 3, Note 6 


T14 


HLDA Valid Delay 


4 


28 


4-7 


C = 50 pF 

L r 


T15 


NA#, SUSP#, FLUSH#, KEN#, 
A20M# Setup Time 


5 




4-3 




T16 


NA#, SUSP#, FLUSH#, KEN#, 
A20M# Hold Time 


12 




4-3 




T19 


READY# Setup Time 


12 




4-3 




T20 


,READY# Hold Time 


4 




4-3 




T21 


D15-D0 Read Data Setup Time 


9 




4-3 




T22 


D15-D0 Read Data Hold Time 


6 




4-3 




T23 


HOLD Setup Time 


17 




4-3 




T24 


HOLD Hold Time 


5 




4-3 




T25 


RESET Setup Time 


12 




4-8 




T26 


RESET Hold Time 


4 




4-8 




T27 


INTR, NMI, SMI# Setup Time 


16 




4-3 


Note 4 


T28 


INTR, NMI, SMI# Hold Time 


16 




4-3 


Note 4 


T29 


PEREQ, ERROR#, BUSY# 


14 




4-3 


Note 4 


T30 


Setup Time 

PEREQ, ERROR#, BUSY# 
Hold Time 


5 




4-3 


Note 4 



Note: Refer to AC Characteristics Notes on page 4-11. 
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Table 4-8. AC Characteristics for Cx486SLC/e-25, Cx486SLC/e-V25 

Cx486SLGe-25: V cc = 5.0 V ± 10%, T c = 0° to 100°C Cx486SLC/e-V25: V cc = 3.0 to 3.6 V, T c = 0° to 85° C 







25 MHz 






SYMBOL 


PARAMETER 


MIN 

(ns) 


MAX 
(ns) 


FIGURE 


NOTES 


Tl 


CLK2 Period 


zu 




4-2 


Note 1 


T2a 


CLK2 High Time 


7 




4-2 


Note 2 


T2b 


CLK2 High Time 


. A 
' \ 




4-2 


Note 2 


T3a 


CLK2 Low Time 


7 




4-2 


Note 2 


T3b 


CLK2 Low Time 


5 




4-2 


Note 2 


T4 


CLK2 Fall Time 




7 


4-2 


Note 2 


T5 


CLK2 Rise Time 




7 


4-2 


Note 2 


T6 


A23-A1, SM1# Valid Delay 


4 


21 


4-4, 4-7 


C L = 50 pF 


T7 


A23-A1 Float Delay 


4 


30 


4-7 


Note 3 


T8 ' 


BHE#, BLE#, LOCK# Valid Delay 


A. 


Zl 


4-4, 4-7 


C L = 50 pF 


T9 


BHE#, BLE#, LOCK# Float Delay 


4 




4-7 


Note 3 


T10 


ADS#, D/C#, M/IO#, SMADS# 
RPLVAL#, W/R# Valid Delay 


4 


Zl 


4-4, 4-7 


C L = 50 pF 


Til 


ADS#, D/C#, M/IO#, SMADS# 
RPLVAL#, W/R# Float Delay 


4 


30 


4-7 


Note 3 


T12 


D15-D0 Write Data, RPLSET, 


7 


27 


4-4, 4-5 


C L = 50 pF, Note 5 




SUSPA# Valid Delay 








T12a 


D15-D0 Write Data Hold Time 


2 




4-6 




T13 


D15-D0 Write Data, RPLSET, 
SUSPA# Float Delay 


4 


22 


4-7 


Note 3, Note 6 


T14 


HLDA Valid Delay 


4 


22 


4-7 


C L = 50 pF 


T15 


NA#, SUSP#, FLUSH#, KEN#, 
A20M# Setup Time 


5 




4-3 




T16 


NA#, SUSP#, FLUSH#, KEN#, 
A20M# Hold Time 


3 




4-3 




T19 


READY# Setup Time 


9 




4-3 




T20 


READY# Hold Time 


4 




4-3 




T21 


D15-D0 Read Data Setup Time 


7 




4-3 




T22 


D15-D0 Read Data Hold Time 


5 




4-3 




T23 


HOLD Setup Time 


9 




4-3 




T24 


HOLD Hold Time 


3 




4-3 




T25 


RESET Setup Time 


8 




4-8 




T26 


RESET Hold Time 


3 




4-8 




T27 


INTR, NMI, SMI# Setup Time 


6 




4-3 


Note 4 


T28 


1NTR, NMI, SMI# Hold Time 


6 




4-3 


Note 4 


T29 


PEREQ, ERROR#, BUSY# 


6 




4-3 


Note 4 


T30 


Setup Time 

PEREQ, ERROR#, BUSY# 
Hold Time 


5 




4-3 


Note 4 



Note: Refer to AC Characteristics Notes on page 4-11. 
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Table 4-9. AC Characteristics for Cx486SLC/e-33 

Cx486SL(7e-33: V cc = 5.0 V ± 5%, T c = 0° to 100°C 







33 MHz 






SYMBOL 


PARAMETER 


MIN 


MAX 


FIGURE 


NOTES 






Insl 


Insl 
l n *l 






Tl 


CLK2 Period 


15 




4-2 


Note 1 


T2a 


CLK2 High Time 


6.25 




4-2 


Note 2 


T2b 


GLK2 High Time 


4.5 




4-2 


Note 2 


T3a 


CLK2 Low Time 


6.25 




4-2 


Note 2 


T3b 


CLK2 Low Time 


4.5 




4-2 


Note 2 


T4 


CLK2 Fall Time 




4 


4-2 


Note 2 


T5 


CLK2 Rise Time 




4 


4-2 


Note 2 


T6 


A23-A1, SMI# Valid Delay 


4 


15 


4_4 5 4_7 


Cl = 50 pF 


T7 


A23-A1 Float Delay 


4 


20 


4-7 


Note 3 


T8 


BHE#, BLE#, LOCK#, Valid Delay 


4 


15 


4-4, 4-7 


Q = 50 pF 


T9 


BHE#, BLE#, LOCK#, Float Delay 


4 


20 


4-7 


Note 3 ' 


.no 


ADS#, D/C#, M/IO#, RPLVAL#, 


4 


15 


4-4, 4-7 


Q = 50 pF 




SMADS#, W/R# Valid Delay 








Til 


ADS#, D/C#, M/IO#, RPLVAL#, 


4 


20 


4-7 


Note 3 




SMADS#, W/R# Float Delay 










T12 


D15-D0 Write Data, RPLSET, 


7 


24 


4-4, 4-5 


Cl = 50 pF, Note 5 




SUSPA# Valid Delay 








T12a 


D15-D0 Write Data, Hold Time 


2 




4-6 




T13 


D15-D0 Write Data, RPLSET, 


4 


17 


4-7 


Note 3, Note 6 




SUSPA# Float Delay 










T14 


HLDA Valid Delay 


4 


20 


4-7 


Cl = 50 pF 


T15 


A20#, FLUSH#, KEN#, NA#, SUSP# 


5 




4-3 






Setup Time 










T16 


A20#, FLUSH#, KEN#, NA#, SUSP# 


3 




4-3 






Hold Time 










T19 


READY# Setup Time 


7 




4-3 




T20 


READY# Hold Time 


4 




4-3 




T21 


D15-D0 , Read Data Setup Tim.e 


5 




4-3 




T22 


D15-D0 , Read Data Hold Time 


3 




4-3 




T23 


HOLD Setup Time 


11 




4-3 




T24 


HOLD Hold Time 


2 




■ 4-3 




T25 


RESET Setup Time 


5 




4-8 




T26 


RESET Hold Time 


2 




4-8 




T27 


NMI, INTR, SMI# Setup Time 


5 




4-3 


Note 4 


T28 


NMI, INTR, SMI# Hold Time 


5 




4-3 


Note 4 


T29 


PEREQ, ERROR#, BUSY# 


5 




4-3 


Note 4 




Setup Time 










T30 


PEREQ, ERROR#, BUSY# 


4 




*4-3 


Note 4 




Hold Time 











Note: Refer to AC Characteristics Notes on page 4-11. 
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AC Characteristics Notes for Tables 4-7 through 4-9: 

1 . Input clock can be stopped, therefore minimum CLK2 frequency is MHz. 

2. These parameters are not tested. They are guaranteed by design characterization. 

3. Float condition occurs when maximum output current becomes less than I LI in magnitude. Float is not 100% tested. 

4. These inputs are allowed to be asynchronous to CLK2. The setup and hold specifications are given for testing purposes, to assure 
recognition within a specific CLK2 period. 

5. T12 minimum time is not 100% tested. 

6. SUSPA# floats only in response to activation of FLT#. SUSPA# does not float during a hold acknowledge state. 



CLK2 



READY# 



HOLD 



D15-D0 



PEREQ, ERROR#, 
BUSY# 



NA#, SUSP#, FLUSH#, 
KEN#, A20M# 



NMI, INTR, SMI# 



Tx 



02 



WK 



-T19— ^ 



Tx 

01 02 



-T20- 



-T23- 



Tzm 

ML 



-T24- 



T21- 



WHL 



-T22- 



T29—> 



<e— T30- 



mm 



T15- 



<— T16- 



WDk 



-121- 



01 



mzi 



-T28 



WL 



Tx 



Figure 4-3. Input Signal Setup and Hold Timing 
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Tx 



CLK2 



BHE#, BLE#, 
LOCK# 

ADS#, D/C#, 
M/IO#, RPLVAL#, 
SMADS#, W/R# 



A23-A1,SMI# 



RPLSET, SUSPA# 



02 



T8_ 



Tx 

01 02 



Valid 



01 
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MIN 



Valid 



MIN 

T12- 



MAX 



Valid i 



MAX 



Valid n+1 



MIN 



MAX 



Valid n+1 



Figure 4-4. Output Signal Valid Delay Timing 
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Figure 4-5. Data Write Cycle Valid Delay Timing 
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Figure 4-6. Data Write Cycle Hold Timing 
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Figure 4-7. Output Signal Float Delay and HLDA Valid Delay Timing 
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Figure 4-8. RESET Setup and Hold Timing 
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5. MECHANICAL SPECIFICATIONS 

5. 1 Pin Assignments 

The pin assignments for the Cx486SLC/e are shown in Figure 5-1. The signal names are shown in 
Table 5-1 sorted by pin numbers and in Table 5-2 sorted by signal name. 




DO 






c 


1 


Vss 


c 


2 


HLDA 






c 


3 


HOLD 


c 


4 


Vss 


c 


5 


NA# 


C 


6 


READY# 


c 


7 


Vcc 


<■ 


8 


Vcc 


C 


9 


Vcc 


c 


10 


Vss 


c 


11 


Vss 


c 


12 


Vss 


c 


13 


Vss 


c 


14 


CLK2 


c 


15 


ADS# 


c 


16 


BLE# 


c 


17 


Al 


c 


18 


BHE# 


£ 


19 


SMADS# 


c 


20 


Vcc 


c 


21 


Vss 


C 


22 


M/IO# 


c 


23 


D/C# 


c 


24 


W/R# 


c 


25 










HfN w O^tin^ON OOOO^Hr _ .......... 
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N/C = No Connect 



Figure 5-1. Pin Assignments 
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Table 5-1. Signal Names Sorted by Pin Number 



PIN 
NO. 


SIGNAL 
NAME 


PIN 
NO. 


SIGNAL 
NAME 


PIN 
NO. 


SIGNAL 
NAME 


PIN 
NO. 


SIGNAL 
NAME 


PIN 
NO. 


SIGNAL 
NAME 


1 


DO 


21 


V cc 


41 


V ss 


61 


All 


81 


D15 


2 


V ss 


22 


v ss 


42 


V cc 


62 


A12- 


82 


D14 


3 


HLDA 


23 


M/IO# 


43 


SUSP# 


63 


V ss 


83 


D13 


4 


HOLD 


24 


D/C# 


44 


SUSPA# 


64 


A13 


84 


V cc 


5 


V ss 


25 


W/R# 


45 


RPLSET 


65 


A14 


85 


V ss 


6 


NA# 


26 


LOCK# 


46 


RPLVAL# 


66 


A15 


86 


D12 


7 


READY# 


27 


N/C 


47 


SMI# 


67 


v ss 


87 


Dll 


8 


V cc 


28 


FLT# 


48 


V cc 


68 


v ss 


88 


D10 


9 


V cc 


29 


KEN# 


49 


V ss 


69 


V cc 


89 


D9 


10 


V cc 


30 


FLUSH# 


50 


v ss 


70 


A16 


90 


D8 


11 


V 

ss 


31 


A20M# 


51 


A2 


71 


V cc 


91 


V 

cc 


12 


V ss' 


32 


V cc 


52 


A3 


72 


A17 


92 


D7 


13 


v cc 

ss 


33 


RESET 


53 


A4 


73 


A18 


93 


D6 


14 


V ss 


34 


BUSY# 


54 


A5 


74 


A19 


94 


D5 


15 


CLK2 


35 


v ss 


55 


A6 


75 


A20 


95 


D4 


16 


ADS# 


36 


ERROR# 


56 


A7 


76 


A21 


96 


D3 


17 


BLE# 


37 


PEREQ 


57 


V cc 


77 


V ss 


97 


V cc 


18 


Al 


38 


NMI 


58 


A8 


78 


V ss 


98 


V ss 


19 


BHE# 


39 


V 

cc 


59 


A9 


79 


A22 


99 


D2 


20 


SMADS# 


40 


INTR 


60 


A10 


80 


A23 


100 


Dl 



5-2 



PRELIMINARY 



Pin Assignments 



5 



Table 5-2. Pin Numbers Sorted by Signal Name 



SIGNAL 
NAME 


PIN 
NO. 


SIGNAL 
NAME 


PIN 
NO. 


aiWNHIi 

NAME 


DIN 

NO. 


NAME 


PIN 
NO. 


SIGNAL 
NAME 


PIN 
NO. 


Al 


18 


A21 


76 


Dll 


87 


RESET 


33 




97 


A2 


51 


A22 


79 


D12 


86 


RPLSET 


45 


v ss 


2 


A3 


52 


A23 


80 


D13 


83 


RPLVAL# 


46 




5 


A4 


53 


ADS# 


16 


D14 


82 


SMADS# 


20 


V ss 


11 


A5 


54 


A20M# 


31 


D15 


81 


SMI# 


47 


V ss 


12 


A6 


55 


BHE# 


19 


D/C# 


24 


SUSP# 


43 


v ss 


13 


A7 


56 


BLE# 


17 


ERROR# 


36 


SUSPA# 


44 


V ss 


14 


A8 


58 


BUSY# 


34 


FLT# 


28 


V cc 


8 


V ss 


22 


A9 


59 


CLK2 


15 


FLUSH# 


30 


V cc 


9 


V ss 


35 


A10 


60 


DO 


1 


HOLD 


4 


V cc 


10 


V ss 


41 


All 


61 


Dl 


100 


HLDA 


3 


V cc 


21 


V ss 


49 


A12 


62 


D2 


99 


INTR 


40 


V cc 


32 


V ss 


50 


A13 


64 


D3 


96 


KEN# 


29 


v rr 

cc 


39 


Vcc 

ss 


63 


A14 


65 


D4 


95 


LOCK# 


26 


V cc 


42 


v ss 


67 


A15 


66 


D5 


94 


M/10# 


23 


V cc - 


48 


V ss 


68 


A16 


70 


D6 


93 


NA# 


6 


v cc 


57 


V ss 


77 


A17 


72 


D7 


92 


N/C 


27 


v cc 


69 


v ss 


78 


A18 


73 


D8 


90 


NMI 


38 


V cc 


71 


V ss 


85 


A19 


74 


D9 


89 


PEREQ 


37 


V cc 


84 


V ss 


98 


A20 


75 


D10 


88 


READY# 


7 


V cc 


91 


W/R# 


25 
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5.2 Package Dimensions 



1 o 



0.140TYP 
(3.56) 



0.020 0-8 
(0.51) MIN 



0.600 REF 




TOP SIDE VIEW 



d °, 

] £ q 




- 0.010 TYP 
(0.20) 



1_ 



82 

o . 
d o, 

+1 +l 

00 (N 



d °, 

8 °9 

On <N 

d C5 



0.170 + 0.010 
(4,32 +0.25/-0.26) 



(0.635) 



0.020 MIN 
(0.51) 



Note: All dimensions in inches (millimeters). 

*Note: For metal BQFP package only: 0.735 ± 0.003 (18.64 ± 0.08) 



Figure 5-2. 1 OO-Pin BQFP Package Dimensions 
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5.3 Thermal Characteristics 

The Cx486SLC/e is designed to operate when case temperature is between 0° - 100°C and between 
0° - 85° C for the Cx486SLC/e-V. The case temperature is measured on the top center of the package. 
The maximum die temperature (T and the maximum ambient temperature (T a MAX ) can be calcu- 
lated using the following equations. 



T 

j MAX 


t + (p AY x e. ) 

c ^ MAX jc y 


T 

aMAX 


t. - (p uay x e.) 

j v MAX ja' 


T 

jMAX 


= Maximum average junction temperature (°C) 


T 

c 


= Case temperature at top center of package (°C) 


p 

MAX 


= Maximum device power dissipation (W) 


e 


= Junction-to-case thermal resistance (°C/W) 


T 

aMAX 


= Maximum ambient temperature (°C) 


T. 
j 


= Average junction temperature (°C) 


e. 

ia 


= Junction-to-ambient thermal resistance (°C/W) 



The junction-to-ambient and junction-to-case thermal resistances of the 100-lead Bumpered Quad Flat 
Pack (BQFP) package are listed in Table 5-3 for various airflows. Tables 5-4 and 5-5 list the maximum 
ambient temperatures permitted for various clock frequencies and airflows. 



Table 5-3. Package Thermal Resistance and Airflow 



AIRFLOW 
( FT/MI N) 


THERMAL RESISTANCE (°C/W) 
lOO-LEAD BQFP 


e 


e 





21 


2 


100 


19 


2 


250 


16 


2 


500 


13 


2 
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Table 5-4. Cx486SLC/e Maximum Ambient Temperature (T A ) 
for Various Airflows and Clock Frequencies 



'ciK 


AIRFLOW 

(ft/min) 


(MHZ) 





100 


250 


500 


20 


67°C 


7FC 


76°C 


79°C 


25 


60°C 


65°C 


71°C 


75°C 


33 


50°C 


56°C 


63°C 


69°C 



Note: Table refers to temperature specifications only and does not necessarily reflect part availability. 



Table 5-5. Cx4 8 6SLC/e- V Maximum Ambient Temperature (T A ) 
for Various Airflows and Clock Frequencies 



'cue 
(MHZ) 


AIRFLOW 
(ft/min) 





100 


250 


500 


20 


65°C 


67°C 


70°C 


72°C 


25 


61°C 


64°C 


68°C 


70°C 


33 


55°C 


58°C 


63°C 


66°C 



Note: Table refers to temperature specifications only and does not necessarily reflect part availability. 
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6. INSTRUCTION SET 

This section summarizes the Cx486SLC/e instruc- 
tion set and provides detailed information on the 
instruction encodings. All instructions are listed 
in the Instruction Set Summary Table 
(Table 6-16), which provides information on the 
instruction encoding, which flags are effected, and 
the instruction clock counts for each instruction. 
The clock count values are based on the assump- 
tions described in section 6.3. 



6.1 General Instruction 
Format 

All of the Cx486SLC/e machine instructions 
follow the general instruction format shown in 
Figure 6-1. These instructions vary in length and 
can start at any byte address. An instruction 
consists of one or more bytes that can include: 
prefix byte(s), at least one opcode byte(s), mod 
r/m byte, s-i-b byte, address displacement byte(s) 
and immediate data byte(s). An instruction can 
be as short as one byte and as long as 15 bytes. If 
there are more than 15 bytes in the instruction a 
general protection fault (error code of 0) is 
generated. 



|PPPPPPPP|TTTTTTTT| mod R R R r/m | ss index base | 32 |l6 | S ] none | 32 |l6 | 8 | r 
7 07 0765320765320 



V Y Y Y Y Y 

optional prefix byte(s) op-code mod r/m s-i-b address immediate 

(one or two bytes) b y te b y te displacement data 

. , (4,2, 1 bytes, (4, 2, 1 bytes, 

v - y or none) or none) 

P = prefix bit register and address 

T = opcode bit mode specifier 

R = opcode bit or reg bit 171 



Figure 6- 1 • General Instruction Format 
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6.2 



Instruction Fields 



The general instruction format shows the larger 
fields that make up an instruction. Certain 
instructions have smaller encoding fields that 
vary according to the class of operation. These 



fields define information such as the direction 
of the operation, the size of the displacements, 
register encoding and sign extension. All the 
fields are described in Table 6-1 and the subse- 
quent paragraphs provide greater detail. 



Table 6- 1 • Instruction Fields 



FIELD NAME 


DESCRIPTION 


NUMBER OF BITS 


Prefix 


Specifies segment register override, address and operand size, 
repeat elements in string instruction, LOCK# assertion. 


8 per byte 


Opcode 


Identifies instruction operation. 


1 or 2 bytes 


w 


Specifies if data is byte or full size (full size is either 16 or 32 bits). 


1 


d 


Specifies direction of data operation: 


1 


s 


Specifies if an immediate data field must be sign-extended. 


1 


reg 


General register specifier. 


3 


mod r/m 


Address mode specifier. 


2 for mod; 3 for r/m 


ss 


Scale factor for scaled index address mode. 


2 


index 


General register to be used as index register. 


3 


base 


General register to be used as base register. 


2 


sreg2 


Segment register for CS, SS DS and ES. 


2 


sreg3 


Segment register ifor CS, SS, DS ES FS and GS. 


3 


eee 


Control, debug and test register specifier. 


3 


Address displacement 


Address displacement operand. 


1 , 2 or 4 bytes 


Immediate data 


Immediate data operand. 


1, 2 or 4 bytes 
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6.2.1 Prefixes 

Prefix bytes can be placed in front of any 
instruction. The prefix modifies the operation 
of the next instruction only. When more than 
one prefix is used, the order is not important. 
There are five type of prefixes as follows: 

1 . Segment Override explicitly specifies 
which segment register an instruction will 
use. 

2. Address Size switches between 16- and 
32-bit addressing. Selects the inverse of 
the default. 

3. Operand Size switches between 16- and 
32-bit addressing. Selects the inverse of 
the default. 



4. Repeat is used with a string instruction 
which causes the instruction to be re- 
peated for each element of the string. 

5. Lock is used to assert the hardware 
LOCK# signal during execution of the 
instruction. 

Table 6-2 lists the encodings for each of the 
available prefix bytes. The operand size and 
address size prefixes allow the individual 
overriding of the default value for operand size 
and effective address size. The presence of 
these prefixes select the opposite (non-default) 
operand size and/or effective address size as' the 
case may be. 



Table 6-2. Instruction Prefix Summary 



PREFIX 


ENCODING 


DESCRIPTION 


ES: 


26h 


Overide segment default, use ES for memory operand 


CS: 


2Eh 


Overide segment default, use CS for memory operand 


SS: 


36h 


Overide segment default, use SS for memory operand 


DS: 


3Eh 


Overide segment default, use DS for memory operand 


FS: ~ 


64h 


Overide segment default, use FS for memory operand 


GS: 


' 65h 


Overide segment default, use GS for memory operand 


Operand Size 


66h 


Make operand size attribute the inverse of the default 


Address Size 


67h 


Make address size attribute the inverse of the default 


LOCK 


FOh 


Assert LOCK# hardware signal. 


REPNE 


F2h 


Repeat the following string instruction. 


REP/REPE 


. F3h 


Repeat the following string instruction. 
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6.2.2 Opcode Field 

The opcode field is either one or two bytes in 
length and specifies the operation to be per- 
formed by the instruction. Some operations 
have more than one opcode, each specifying a 
different form of the operation. Some opcodes 
name instruction groups. For example, opcode 
0x80 names a group of operations that have an 



immediate operand, and a register or memory 
operand. The group opcodes use an opcode . 
extension field of 3 bits in the following byte, 
called the MOD R/M byte, to resolve the 
operation type.- Opcodes for the entire 
Cx486SLC/e instruction set are listed in the 
Instruction Set Summary Table. The opcodes 
are given in hex values unless shown within 
brackets ([ ]). Values shown in brackets are 
binary values. 



6.2.3 w Field 

The 1-bit w field indicates the operand size during 16- and 32- bit data operations. 

Table 6-3. w Field Encoding 



w FIELD 


OPERAND SIZE 
1 6-BIT DATA OPERATIONS 


OPERAND SIZE 
32-BIT DATA OPERATIONS 





8 Bits 


8 Bits 


1 


16 Bits 


32 Bits 



6.2.4 d Field 

The d field determines which operand is taken as the source operand and which operand is taken 
as the destination. 

Table 6-4. d Field Encoding 



d FIELD 


DIRECTION OF OPERATION 


SOURCE OPERAND 


DESTINATION OPERAND 





Register --> Register/Memory 
Register/Memory --> Register 


reg 


mod r/m or 

mod ss-index-base 


1 




mod r/m or 

mod ss-index-base 


reg 
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6.2.5 reg Field 

The reg field determines which general registers are to be used. The selected register is dependent 
on whether 16- or 32- bit operation is current and the status of the 11 w" bit. 



Table 6-5. reg Field Encoding 



reg 


16-BIT 
OPERATION 
w Field Not 
Present 


32-BIT 
OPERATION 
w Field Not 

Present 


1 6-BIT 
OPERATION 
w=0 


1 6-BIT 
OPERATION 

w=l 


32-BIT 
OPERATION 

w=0 


32-BIT 
OPERATION 

w=l 


000 


AX 


EAX 


AL 


AX 


AL 


EAX 


001 


CX 


ECX 


CL 


CX 


CL 


ECX 


010 


DX 


EDX 


DL 


DX 


DL 


EDX 


011 


BX 


EBX 


BL 


BX 


BL 


EBX 


100 


SP 


ESP 


AH 


SP 


AH 


ESP 


101 


BP 


EBP 


CH 


BP 


CH 


EBP 


110 


SI 


ESI 


DH 


SI 


DH 


ESI 


111 


DI 


EDI 


BH 


DI 


BH 


EDI 
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6.2.6 mod and r/m Fields 

The mod and r/m sub-fields, within the mod 
r/m byte, select the type of memory addressing 
to be used. Some instructions use a fixed 
addressing mode (e.g., PUSH or POP) and 



therefore, these fields are not present. 
Table 6-6 lists the addressing method when 
16-bit addressing is used and a mod r/m byte is 
present. Some mod r/m field encodings are 
dependent on the w field and are shown in 
Table 6-6A. 



Table 6-6. mod r/m Field Encoding 



mod r/m 


1 6-BIT ADDRESS 
MODE 
with mod r/m Byte 


32-BIT ADDRESS MODE 
with mod r/m Byte and 
No s-i-b Byte Present 


00 000 


DS:[BX+SI] 


DS:[EAX] 


00 001 


DS:[BX+DI] 


DS:[ECX] 


00 010 


SS:[BP+SI] 


DS:[EDX] 


00 011 


SS:[BP+DI] 


DS:[EBX] 


00 100 


DS:[SI] 


s-i-b is present (See 6.2.7) 


00 101 


DS:[DI] 


DS:[d32] 


00 110 


DS:[dl6] 


DS:[ESI] 


00 111 


DS:[BX] 


DS:[EDI] 








01 000 


DS:[BX+SI+d8] 


DS:[EAX+d8] 


01001 


DS:[BX+DI+d8] 


DS:[ECX+d8] 


01010 


SS:[BP+SI+d8] 


DS:[EDX+d8] 


01011 


SS:[BP+DI+d8] 


DS:[EBX+d8] 


01 100 


DS:[SI+d8] 


s-i-b is present (See 6.2.7) 


01 101 


DS:[DI+d8] 


SS:[EBP+d8] 


01 110 


SS:[BP+d8] 


DS:[ESI+d8] 


01 111 


DS:[BX+d8] 


DS:[EDI+d8] 








10 000 


DS:[BX+SI+dl6] 


DS:[EAX+d32] 


10 001 


DS:[BX+DI+dl6] 


DS:[ECX+d32] 


10 010 


SS:[BP+Sl+dl6] 


DS:[EDX+d32] 


10 011 


SS:[BP+DI+dl6] 


DS:[EBX+d32] 


10 100 


DS:[SI+dl6] 


s-i-b is present (See 6.2.7) 


10 101 


DS:[DI+dl6] 


SS:[EBP+d32] 


10 110 


SS:[BP+dl6] 


DS:[ESI+d32] 


10 111 


DS:[BX+dl6] 


DS:[EDI+d32] 








11000-11 111 


See Table 6-6A 


See Table 6-6A 
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Table 6-6A. mod r/m Field Encoding Dependent on w Field 



mod r/m 


1 6-BIT 
OPERATION 

w=0 


16-BIT 
OPERATION 

w=l 


32-BIT 
OPERATION 

w=0 


32-BIT 
OPERATION 
w=l 


11000 


AL 


AX 


AL 


EAX 


11001 


CL 


CX 


CL 


ECX 


11010 


DL 


DX 


DL 


EDX 


noir 


BL 


BX 


BL 


EBX 


11 100 


AH 


SP 


AH 


ESP 


11 101 


CH 


BP 


CH 


EBP 


11 110 


DH 


SI 


DH 


ESI 


n in 


BH 


DI 


■ BH 


EDI 
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6.2.7 mod and base Fields 

In Table 6-6A, the note "s-i-b present" for 
certain entries forces the use of the mod and 
base field as listed in Table 6-7. 



Table 6-7. mod base Field Encoding 



mod base 


32-BIT ADDRESS MODE 
with mod r/m and 
s-i-b Bytes Present 


00 000 


DS:[EAX+(scaled index)] 


00 001 


DS:[ECX+(scaled index)] 


00 010 


DS:[EDX+(scaled index)] 


00011 


DS: [EBX+(scaled index)] 


00 100 


SS:[ESP+(scaled index)] 


00 101 


DS:[d32+(scaled index)] . 


00110 


DS:[ESI+(scaled index)] 


00111 


DS:[EDI+(scaled index)] 






01000 


DS:[EAX+(scaled index)+d8] 


01001 


DS: [ECX+(scaled index)+d8] 


01010 


DS: [EDX+(scaled index)+d8] 


01011 


DS: [EBX+(scaled index)+d8] 


01 100 


SS:[ESP+(scaled index)+d8] 


01101 


SS:[EBP+(scaled index)+d8] 


01 110 


DS: [ESI+(scaled index)+d8] 


01 111 


DS: [EDI+(scaled index)+d8] 






10 000 


DS: [EAX+(scaled index)+d32] 


10 001 


DS: [ECX+(scaled index)+d32] 


10 010 


DS:[EDX+(scaled index)+d32] 


10011 


DS: [EBX+(scaled index)+d32] 


10100 


SS:[ESP+(scaled index)+d32] 


10101 


SS: [EBP+(scaled index)+d32] 


10110 


DS:[ESl+(scaled index)+d32] 


10111 


DS: [EDI+(scaled index)+d32] 



6.2.8 ss Field 

The ss field (Table 6-8) specifies the scale factor 
used in the offset mechanism for address 
calculation. The scale factor multiplies the 
index value to provide one of the components 
used to calculate the offset address. 



Table 6-8. ss Field Encoding 



ss FIELD 


SCALE FACTOR 


00 


xl 


01 


x2 


10 


x4 


11 


x8 



6.2.9 index Field 

The index field (Table 6-9) specifies the index 
register used by the offset mechanism for offset 
address calculation. When no index register is 
used (index field = 100), the ss value must be 
00 or the effective address is undefined. 



Table 6-9. index Field Encoding 



index FIELD 


INDEX REGISTER 


000 


EAX 


001 


ECX 


010 


EDX 


011 


EBX 


100 


none 


101 


EBP 


110 


ESI 


111 


EDI 
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6.2. 1 sreg2 Field 

The sreg2 field (Table 6-10) is a 2-bit field that 
allows one of the four 286-type segment regis- 
ters to be specified. 



6.2.11 sreg3 Field 

The sreg3 field (Table 6-11) is 3-bit field that is 
similar to the sreg2 field, but allows use of the 
FS and GS segment registers. 



Table 6- lO. sreg2 Field Encoding 



Table 6-11. sreg3 Field Encoding 



sreg2 FIELD 


SEGMENT REGISTER SELECTED 


00 


. ES 


01 


cs 


10 


ss 


11 


DS 



sreg3 FIELD 


SEGMENT REGISTER SELECTED 


000 


• ES 


001 


CS 


010 


SS 


011 


DS 


100 


FS 


101 


GS 


110 


undefined 


111 


undefined 



6.2.12 eee Field 

The eee field is used to select the control, debug and test registers as indicated in Table 6-12. The 
values shown in Table 6-12 are the only valid encodings for the eee bits. 

Table 6- 1 2. eee Field Encoding 



eee FIELD 


REGISTER TYPE 


BASE REGISTER 


000 


Control Register 


CR0 


010 


Control Register 


CR2 


011 


Control Register 


CR3 


000 


Debug Register 


DR0 


001 


Debug Register 


DR1 


010 


Debug Register 


DR2 


011 


Debug Register 


DR3 


110 


Debug Register 


DR6 


111 


Debug Register 


DR7 


011 


Test Register 


TR3 


100 


Test Register 


TR4 


101 


Test Register 


TR5 


110 


Test Register 


TR6 


111 


Test Register 


TR7 
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6.3 



Flags 



The Instruction Set Summary Table lists nine 
flags that are affected by the execution of 
instructions. The conventions shown in 
Table 6-13 are used to identify the different 
flags. Table 6-14 lists the conventions used to 
indicate what action the instruction has on the 
particular flag. 

Table 6-13. Flag Abbreviations 



ABBREVIATION 


NAME OF FLAG 


OF 


Overflow Flag 


DF 


Direction Flag 


IF 


Interrupt Enable Flag 


TF 


Trap Flag 


SF 


Sign Flag 


ZF 


Zero Flag 


AF 


Auxiliary Flag 


PF 


Parity Flag 


CF 


Carry Flag 



Table 6- 1 4. Action of Instruction on Flag 



INSTRUCTION 
TABLE 
SYMBOL 


ACTION 


X 


Flag is modified by the instruction. 




Flag is not changed by the instruction. 





Flag is reset to "0". 


1 


Flag is set to "1". 



6.4 Clock Counts 

6.4. 1 Assumptions 

The following assumptions have been made in 
presenting the clock count values for the 
individual instructions: 

1 . The instruction has been prefetched, 
decoded and is ready for execution. 

2. Bus cycles do not require wait states. 

3. There are no local bus HOLD requests 
delaying processor access to the bus. 

4. No exceptions are detected during in- 
struction execution. 

5. If an effective address is calculated, it does 
not use two general register components. 
One register, scaling and displacement 
can be used within the clock count 
shown. However, if the effective address 
calculation uses two general register 
components, add 1 clock to the clock 
count shown. 

6. All clock counts assume aligned 16-bit 
memory/IO operands for cache miss 
counts. 

7. If instructions access a misaligned 16-bit 
operand or a 32-bit operand on even 
address, add 2 clocks for read or write 
and add 4 clock counts for read and 
write. 

8. If instructions access a 32-bit operand on 
odd addresses, add 4 clocks for read or 
write and add 8 clocks for read and write. 
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6.4.2 Abbreviations 



The clock counts listed in the Instruction Set Summary Table are grouped by operating mode 
and whether there is a register/cache hit or a cache miss. In some cases, -more than one clock 
count is shown in a column for a given instruction, or a variable is used in the clock count. The 
abbreviations used for these conditions are listed in Table 6-15. 



Table 6- 1 5. Clock Count Abbreviations 



CLOCK 
COUNT 
SYMBOL 


EXPLANATION 


/ 


Register operand/memory operand. 


n 


Number of times operation is repeated. 


L 


Level of the stack frame. 


1 


Conditional jump taken | Conditional jump not taken. 

(e.g. "4| 1" = 4 clocks if jump taken, 1 clock if jump not taken) 


\ 


CPL<IOPL \ CPL>IOPL 

(where CPL = Current Privilege Level, IOPL = I/O Privilege Level) 
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I 

Id 



3 



> 

5 



AAA ASCII Adjust AL after Add 



AAD ASCII Adjust AX before Divide 



AAM ASCII Adjust AX after Multiply 



AAS ASCII Adjust AL after Subtract 



Table 6-16. Instruction Set Summary 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



37 



D5 OA 



X X - X 



D4 OA 



X X - X 



16 



3F 




ADC Add with Carry 




X---XXXXX 










b 


h 


Register to Register 


1 [00dw][llregr/m] 




1 




1 








Register to Memory 


1 [OOOw] [mod reg r/m] 




3 


5 


3 


5 






Memory to Register 


1 [00 lw] [mod reg r/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8 [OOsw] [mod 010 r/m]# 




1/3 


5 


1/3 


5 






Immediate to Accumulator 


1 [010w]# 




1 




1 









ADD Integer Add 




X- --XXXXX 










b 


h 


Register to Register 


[OOdwl [11 reg r/m] 




1 




1 








Register to Memory 


[OOOw] [mod reg r/m] 




3 - 


5 


3 


5 






Memory to Register 


[00 lw] [mod reg r/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8 [OOsw] [mod 000 r/m]# 




1/3 


5 


1/3 


5 






Immediate to Accumulator 


[OlOw] # 




1 




1 









AND Boolean AND 




- - - x x - x 










b 


h 


Register to Register 


2 [OOdw] [11 reg r/m] 




1 




1 








Register to Memory 


2 [OOOw] [mod reg r/m] 




3 


5 


3 


5 






Memory to Register 


2 [00 lw] [mod reg r/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8 [OOsw] [modl00r/m]# 




1/3 


5 


1/3 


' 5 






Immediate to Accumulator 


2'[010w] # 




1 




1 









ARPL Adjust Requested Privilege Level 




- - - - - x - - - 










a 


h 


From Register/Memory 


63 [mod reg r/m] 








6/10 


10 







# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 




BOUND Check Array Boundaries 
If Out of Range (Int 5) 
If In Range 


62 [mod reg r/m] 




11+int 
11 




11+int 
11 




b,e 


g.hj.k.r 




BSF Scan Bit Forward 
Register/Memory, Register 


OF BC [mod reg r/m] 


- - - - - x - - - 


5/7+n 


9+n 


5/7+n 


9+n 


b 


h 




BSR Scan Bit Reverse 
Register/Memory, Register 


OF BC [mod reg r/m] 




5/7+n- 


9+n 


5/7+n 


9+n 


b 


h 



BSWAP Byte Swap 



| OF C [1 reg] 



m 

3 



3 



BT Test Bit 

Register/Memory, Immediate 
Register/Memory, Register 


OF BA [mod 100 r/m]# 
OF A3 [mod reg r/m] 


- - - - - - - - X 


3/4 
3/6 


5 
7 


3/4 
3/6 


5 
7 


b 


h 




BTC Test Bit and Complement 
Register/Memory, Immediate 
Register/Memory, Register 


OF BA[modlllr/ 
OF m]# 


- - - - - - - - X 


4/5 
5/8 


6 
9 


4/5 
5/8 


6 
9 


b 


h 


BB [mod reg r/m] 


BTR Test Bit and Reset 
Register/Memory, Immediate 
Register/Memory, Register 


OF BA [mod 110r/m]# 
OF B3 [mod reg r/m] 


- - - - - - - - X 


4/5 
5/8 


6 
9 


4/5 
5/8 


6 
9 


b 


h 




BTS Test Bit and Set 
Register/Memory 
Register (short form) 


OF BA [mod 101 r/m] 
OF AB [mod reg r/m] 


- - - - - - - - X 


3/5 
4/7 


6 
8 


3/5 
. 4/7 


6 
8 


b 


h 



= immediate data 
= 8-bit displacement 



= 16-bit disph 
= 32-bit disph 



x = modified 
(full) - = unchanged 



■ 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



LALL oUDYOUWXC Uult 














b 


h j k r 


Direct ^Vithin Segment 


E8 +++ 




7 




7 








Register/Memory Indirect Within Segment 


FF [mnH 01 r/ml 

1 1 [H1ULI U1U 1/1I1J 




8/9 


10 


8/9 


10 






Direct Intersegment 


QA rnncicrnprl fnll nffcpt 
yr\ [UllMidllCU. lull UlloCl, 




12 




30 








Call Gate to Same Privilege 


cplpptnrl 
OCICCLUI J 








41 


49 






Call Gate to Different Privilege No P 










83 


97 






Call Gate to Different Privilege x P's 










81+4x 


95+4x 






1 f\ Kit Tcicb- tn 1 f\ Kit 










262 


263 






1 fs Kit Tack \r\ 1") Kit TQC! 
10-Dlt laSK tO jZ-Dlt Ijj 










293 


317 






16-bit TasktoV86 Task 










179 


206 






32-bit Task to 16-bit TSS 










238 


258 






32-bit Task to 32-bit TSS 










296 


340 






32-bit Task to V86 Task 










182 


229 






Indirect Intersegment 


FF [modOllr/m] 




14 


17 


14 


34 






Call Gate to Same Privilege 










43 


51 






Call Gate to Different Privilege No P 










85 


99 






Call Gate to Different Privilege Level x P's 










86+4x 


100+4x 






16-bit Task to 16-bit TSS 










267 


268 






16-bit Task to 32-bit TSS 










298 


322 






16-bit Task toV86 Task 










181 


211 






32-bit Task to 16-bit TSS 










243 


263 






32-bit Task to 32-bit TSS 










301 


345 






32-bit Task to V86 Task 










184 


230 







CBW Convert Byte to Word 



CDQ Convert Doubleword to Quadword 



CLC Clear Carry Flag 



F8 



CLD Clear Direction Flag 



FC 



CLI Clear Interrupt Flag 



CLTS Clear Task Switched Flag 



OF 06 



= immediate data 
= 8-bit dispk 



= 16-bit displacement 

= 32-bit displacement (full) 



= modified 
= unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



















CMC Complement the Carry Flag 




- - - - - - - - X 


1 















CMP Compare Integers 




X---XXXXX 










b 


h 


Register to Register 


3 [lOdw] [11 regr/m] 




1 




1 








Register to Memory 


3 [lOlw] [mod reg r/m] 




3 


5 


3 


5 






Memory to Register 


3 [lOOw] [mod reg r/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8 [OOsw] [mod 111 r/m]# 




1/3 


5 


1/3 


5 






Immediate to Accumulator 


3 [HOw] # 




1 




1 









CMPS Compare String 



A [01 lw] 



X X X X X 



CMPXCHG Compare and Exchange 




x - 


- X X x X X 














Register 1, Register 2 


0FB[000w] [llreg2regl] 






5 




5 








Memory, Register 


OF B [OOOw] [mod reg r/m] 






7 


8 


7 


8 







3 

i 
z 

§ 



CWD Convert Word to Doubleword 



CWDE Convert Word to Doubleword 
Extended 


98 




3 




3 









| DAA Decimal Adjust AL after Add 



x x x x x 



DAS Decimal Adjust AL after Subtract 



2F 



X X X X X 



DEC Decrement by 1 
Register/Memory 
Register (short form) 


F[lllw] [mod 001 r/m] 
4 [1 reg] 


x - 


- X X X X - 


1/3 
1 


5 


1/3 
1 


5 


b 


h 




DIV Unsigned Divide 
Accumulator by Register/Memory 
Divisor: Byte 
Word 

Doubleword 


F [01 lw] [mod 110 r/m] 




14/15 
- 22/23- 
38/39 


17 
24 
40 


14/15 
22/23 
38/39 


17 
24 
40 


b,e 


e,h 



I 

in 



= immediate data 
= 8-bit displacement 



= 16-bit displacement 

= 32-bit displacement (full) 



= modified 
= unchanged 



* 








REAL 


PROTECTED 






I 


INSTRUCTION 


OPCODE 


FLAGS 


MODE CLOCK 


MODE CLOCK 


NOTES 


S 








COUNT 


COUNT 












OF DF IF TF SF ZF AF PF CF 


Reg/ 


Cache 


Reg/ 


Cache 


Real 


Protected 










Cache Hit 


Miss 


Cache Hit 


Miss 


Mode 


Mode 



ENTER Enter New Stack Frame 


C8 ++ [8-bit Level] 












b 


h 


Level = 






7 




7 








Level = 1 






10 


10 


10 


10 






Level (L) > 1 






6+4*L 


6+4*L 


6+4*L 


6+4*L 








| HLT Halt 


| F4 | - - 


| 3 | 


1 3 | | | ■ | 





IDIV Integer (Signed) Divide 














b,e 


e,h 


Accumulator by Register/Memory 


F [01 lw] [mod 111 r/m] 
















Divisor: Byte 






19/20 


22 


19/20 


22 






Word 






27/28 


29 -. 


27/28 


29 






Doubleword 






43/44 


47 


43/44 


47 







IMUL Integer (Signed) Multiply 




x - - - 


- - - X 










b 


h 


Accumulator by Register/Memory 


F [01 lw] [mod 101 r/m] 


















Multiplier: Byte 








3/5 


7 


3/5 


7 






Word 








3/5 


7 


3/5 


7 






Doubleword 








7/9 


13 


7/9 


13 






Register with Register/Memory 


OF AF [mod reg r/m] 


















Multiplier: Byte 








3/5 


7 


3/5 


7 






Word 








3/5 


7 


3/5 


7 






Doubleword 








7/9 


13 


7/9 


13 






Register/Memory with Immediate to Register2 


6 [lOsl] [mod reg r/m] # 


















Multiplier: Byte 








3/5 


7 


3/5 


7 






Word 








3/5 


7 


3/5 


7 






Doubleword 








7/9 


13 


7/9 


13 







IN Input from I/O Port 
















m 


Fixed Port 


E [OlOw] [port number] 




16 


16 


6\19 


6\20 






Variable Port 


E [llOw] 




16 


16 


6\19 


6V20 







INC Increment by 1 




X---XXXX- 










b 


h 


Register/Memory 


F [lllw] [mod 000 r/m] 




1/3 


■ -5 


1/3 


5 






Register (short form) 


4 [0 reg] 




1 




1 









# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 






OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 




INS Input String from I/O Port 


6 [HOw] 




20 


20 


6/19 


6/20 


b 


h, m | 













INX Software Interrupt 




- x ----- - 










b,e 


• h r 

gJ> K > r 


INT i 


CD [i] 




14 


16 










Protected Nlode' 


















Interrupt or Trap to Same Privilege 










• 57 


58 






Interrupt or Trap to Different Privilege 










91 


92 






16-bit Task to 16-bit TSS by Task Gate 










265 


266 






16-bit Task to 32-bit TSS by Task Gate 










296 


320 






16-bit Task to V86 by Task Gate 










177 


205 






16-bit Task to 16-bit TSS by Task Gate 










. 241 


261 






32-bit Task to 32-bit TSS by Task Gate 










299 


343 






32-bit Task to V86 by Task Gate • 










180 


232 






V86 to 16-bit TSS by Task Gate 










241 


261 






86 to 32-bit TSS by Task Gate 










299 


343 






86 to Privilege by Trap Gate/Int Gate 










106 


114 






INT 3 


CC 




14 


16 










Protected Mode: 


















Interrupt or Trap to Same Privilege 










57 


58 






Interrupt or Trap to Different Privilege 










91 


92 






16-bit Task to 16-bit TSS by Task Gate 










265 


266 






16-bit Task to 32-bit TSS by Task Gate 










296 


320 






16-bit Task to V86 by Task Gate 










177 


205 






32-bit Task to 16-bit TSS by Task Gate 










241 


261 






32-bit Task to 32-bit TSS by Task Gate 










299 


343 






32-bit Task to V86 by Task Gate 










180 


232 






V86 to 16-bit TSS by Task Gate 










241 


261 






V86 to 32-bit TSS by Task Gate 










299 


343 






V86 to Privilege by Trap Gate/Int Gate 










93 


114 






Continued on the next page ... 



















s 



5 



# = immediate data 
+ = 8-bit displ; 



: 16-bit displacement 

: 32-bit displacement (full) 



i = modified 
■ = unchanged 



■ 



* 








REAL 


PROTECTED 






I 


INSTRUCTION 


OPCODE 


FLAGS 


MODE CLOCK 


MODE CLOCK 


NOTES 


09 








COUNT 


COUNT 












OF DF IF TF SF ZF AF PF CF 


Reg/ 


Cache 


Reg/ 


Cache 


Real 


Protected 










Cache Hit 


Miss 


Cache Hit 


Miss 


Mode 


Mode 



3 
z 

3 



INT Software Interrupt (Continued) 




- - x - - - - - 










b,e 


gj,k,r 


INTO 


CE 














IfOF==0 






1 


1 


1 


1 






IfOF==l (INT 4) 






15 


17 










Protected Mode: 


















Interrupt or Trap to Same Privilege 










57 


58 






Interrupt or Trap to Different Privilege 










91 


92 






16-bit Task to 16-bit TSS by Task Gate 










265 


266 






16-bit Task to 32-bit TSS by Task Gate 










296 


320 






16-bit Task to V86 by Task Gate 










177 


205 






32-bit Task to 16-bit TSS by Task Gate 










241 


261 






32-bit Task to 32-bit TSS by Task Gate 










299 


343 






32-bit Task to V86 by Task Gate 










180 


232 






V86 to 16-bit TSS by Task Gate 










241 


261 






V86 to 32-bit TSS by Task Gate 










299 


343 






V86 to Privilege by Trap Gate/Int Gate 










106 


114 







INVD Invalidate Cache 



OF 08 




INVLPG Invalidate TLB Entry 



OF 01 [mod 111 r/m] 



IRET Interrupt Return 


CF 


xxxxxxxxx 












g,hj,k,r 


Real Mode 






14 


14 










Protected Mode: 


















Within Task to Same Privilege 










35 


37 






Within Task to Different Privilege 










74 


78 






16-bit Task to 16-bit Task 










259 


260 






16-bit Task to 32-bit TSS 










290 


314 






16-bit Task to V86 Task 










. 173 


203 






32-bit Task to 16-bit TSS 










235 


255 






32-bit Task to 32-bit TSS 










295 


339 






32-bit Task to V86 Task 










176 


226 







# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 




JB/JNAE/JC Jump on Below/Not Above or Equal/ 
Carry 

8-bit Displacement 
Full Displacement 


72 + 

OF 82+++ 




411 
411 




611 
611 






r 




JBE/JNA jump on Below or Equal/Not Above 
8-bit Displacement 
Full Displacement 


76 + 

OF 86+++ 




411 
411 




611 
611 






r 




JCXZ Jump on CX Zero | E3 + | - . . - | 7|3 | | 7 1 3 | | | r 




JE/JZ Jump on Equal/Zero 
8-bit Displacement 
Full Displacement 


74 + 

OF 84+++ 




411 
411 




611 
611 






r 



3 



z 
> 

5 



JECXZ Jump on ECXZero 



E3 



713 



713 



JL/JNGE Jump on Less/Not Greater or Equal 
8 -bit Displacement 
Full Displacement . 


7C + 

OF 8C+++ 




411 
411 




611 
611 






r 






JLE/JNG Jump on Less or Equal/Not Greater 
8-bit Displacement 
Full Displacement 


7E + 

OF 8E+++ 




411 
411 




611 
611 






r 





* = immediate data 
- = 8-bit displacement 



= 16-bit displacement x = modified 

= 32-bit displacement (full) - = unchanged 



I 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 




JMP Unconditional Jump 
















b 


h,j,k,r 


Short 


EB 


+ 




4 




6 








Direct within Segment 


E9 


+++ 




4 




6 








Register/Memory Indirect Within Segment 


FF 


[mod 100 r/m] 




6/8 


10 


6/8 


10 






Direct Intersegment 


EA 


rr n rr i l 

[full offset, selector] 




9 




' 26 








Call Gate Same Privilege Level 












45 


45 






16-bit Task to 16-bit TSS 












265 


266 






lo-bit lasK tO jZ-Dlt loo 












zyo 


320 






16-bit Task toV86Task 












182 


209 






32-bit Task to 16-bit TSS 












241 


261 






32-bit Task to 32-bit TSS 












299 


343 






32-bit Task to V86 Task 












185 


232 






Indirect Intersegment 


FF 


[mod 101 r/m] 




11 


14 


30 


30 






Call Gate Same Privilege Level 












47 


47 






16-bit Task to 16-bit TSS 












270 


271 






16-bit Task to 32-bit TSS 












301 


325 






16-bit Task to V86 Task 












184 


214 






32-bit Task to 16-bit TSS 












246 


268 






32-bit Task to 32-bit TSS 












304 


348 






32-bit Task to V86 Task 












187 


237 







JNB/JAE/JNC Jump on Not Below/Above or 
















r 


Equal/Not Carry 






411 




611 








8-bit Displacement 


73 + 




411 




611 








Full Displacement 


OF 83+++ 

















JNBE/JA Jump on Not Below or Equal/Above 
















r 


8-bit Displacement 


77 + 




411 




611 








Full Displacement 


OF 87+++ 




411 




611 









JNE/JNZ Jump on Not Equal/Not Zero 
8-bit Displacement 
Full Displacement 


75 + 

OF 85+++ 




411 
411 




611 
611 






r 




JNL/JGE Jump on Not Less/Greater or Equal 
8-bit Displacement 
Full Displacement 


7D + 

OF 8D+++ 




411 
411 




611 
611 






r 



# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reef/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



JNLE/JG Jump on Not Less or Equal/Greater 
















r 


8-bit Displacement 


7F + 




411 




611 








Full Displacement 


OF 8F +++ 




411 




611 









JNO Jump on Not Overflow 
















r 


8-bit Displacement 


71 + 




411 




611 








Full Displacement 


OF 81 +++ 




411 




611 









JNP/JPO Jump on Not 'Parity •/Parity Odd 
8-bit Displacement 
Full Displacement 


7B + 

OF 8B +++ 




411 
411 




611 
611 






x" 




JNS Jump on Not Sign 
8 -bit Displacement 
Full Displacement 


79 + 

OF 89+++ 




411 
411 




611 
611 






X 




JO Jump on Overflow 
8-bit Displacement 
Full Displacement 


70 + 

OF 80+++ 




411 
411 




611 
611 






X 



JP/JPE Jump on Parity/Parity Even 
8 -bit Displacement 
Full Displacement 


7 A + 

OF 8A+++ 




411 
411 




611 
611 






r 




JS Jump on Sign 
8-bit Displacement 
Full Displacement 


78 + 

OF 88 +++ 




411 
411 




611 
611 






r 



LAHF Load AH with Flags 



9F 



LAR Load Access Rights 














a 




From Register/Memory 


OF 02 [mod reg r/m] 








11/12 


14 







■ 



# = immediate data 
+ = 8-bit displ; 



= 16-bit displacement 

= 32-bit displacement (full) 



= modified 
= unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



ZDS Load Pointer to DS 


C5 [mod reg r/m] 




6 


7 


23 


24 


b 


h,ij 




LEA Load Effective Address 
No Index Register 
With Index Register 


8D [mod reg r/m] 




2 
3 




2 
3 










LEAVE Leave Current Stack Frame 


C9 





3 


4 


3 


4 


b 


h 




LES Load Pointer to ES 


C4 [mod reg r/m] 





6 


7 


23 


24 


b 


h,i,j 



LFS Load Pointer to FS 



OF B4 [mod reg r/m] 



h,i,j 



LGDT Load GDT Register 



OF 01 [mod 010 r/m] 



b,c 



h,l 



LGS Load Pointer to GS 



| OF B5 [mod reg r/m] 



23 



24 



LIDT Load IDT Register 



OF 01 [mod Oil r/m] 



h,l 



LLDT Load LDT Register 
From Register/Memory 


OF 00 [mod 010 r/m] 








16/17 


18 


a 


g,h,jJ 




LMSW Load Machine Status Word 
From Register/Memory 


OF 01 [mod 110 r/m] 




5 


'. 8 


5 


8 


b,c 


h,l 




LODS Load String 


A [llOw] 




4 


4 






b 


h 




LOOP Offset Loop/No Loop 


E2 + 





714 




913 






r 



| LOOPNZ/LOOPNE Offset \ E0 + 



# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



| LOOPZ/LOOPE Offset 



El 



714 



913 



LSL Load Segment Limit 














a 


g.hj,p 


From Register/Memory 


OF 03 [mod reg r/m] 








22/23 


25 







LSS Load Pointer to SS 



I OF B2 [mod reg r/m] 



23 



h,i,i 



LTR Load Task Register 














a 


g.hj,l 


From Register/Memory 


OF 00 [mod reg r/m] 








16/17 


18 





MOV Move Data 
















b 


h,i,j 


Register to Register/Memory 


8 [lOOw] 


[mod reg r/m] 




1/2 


2 


1/2 


2 






Register/Memory to Register 


8 [lOlw] 


[mod reg r/m] 




1/2 


4 


1/2 


4 






Immediate to Register/Memory 


C [01 lw] 


[mod 000 r/m] # 




1/2 


2 


1/2 


2 






Immediate to Register .(short form) 


B [w reg] 


# 




1 




1 








Memory to Accumulator (short form) 


A [OOOw] 






2 


4' 


2 


4 






Accumulator to Memory '(short form) 


A [OOlw] 


+++ 




1/2 


2 


1/2 


2 






Register/Memory to Segment Register 


8E 


[mod sreg3 r/m] 




2/3 


5 


15/16 


18 






Segment Register to Register/Memory 


8C 


[mod reg r/m] 




1/2 


2 


1/2 


2 







MOV Move to/jrom Control/Debug/Test Regs . 
















1 


Register to CR0/CR2/CR3 


OF 22 [11 eee reg] 




11/3/3 




11/3/3 








CR0/CR2/CR3 to Register 


OF 20 [11 eee reg] 




1/3/3 




1/3/3 








Register to DR0-DR3 


OF 23 [11 eee reg] 




1 




1 








DR0-DR3 to Register 


OF 21 [11 eee reg] 




3 




3 








Register to DR6-DR7 


OF 23 [11 eee reg] 




1 




1 








DR6-DR7 to Register 


OF 21 [11 eee reg] 




3 




3 








Register to TR3-5 


OF 26 [11 eee reg] 




5 




5 








TR3-5 to Register 


OF 24 [11 eee reg] 




5 




5 








Register to TR6-TR7 


OF 26 [11 eee reg] 




1 




1 








TR6-TR7 to Register 


OF 24 [11 eee reg] 




3 




3 










MOVS Move String 


A[010w] | -------- - 


5 


5 


5 


5 


b 


h 



t = immediate data 
- = 8-bit displ; 



= 16-bit displacement x = modified 

= 32-bit displacement (full) - = unchanged 



* 








REAL 


PROTECTED 






I 


INSTRUCTION 


OPCODE 


FLAGS 


MODE CLOCK 


MODE CLOCK 


NOTES 










COUNT 


COUNT 












OF DF IF TF SF ZF AF PF CF 


Reg/ 


Cache 


Reg/ 


Cache 


Real 


Protected 










Cache Hit 


Miss 


Cache Hit 


Miss 


Mode 


Mode 



MOVSX Move with Sign Extension 
Register from Register/Memory 


OF B [lllw] [modregr/m] 




1/3 


5 


1/3 


5 


b 


h 




MOVZX Move with Zero Extension 
Register from Register/Memory 


OF B [01 lw] [mod reg r/m] 




2/3 


5 


2/3 


5 


b 


h 




MUL Unsigned Multiply 

Accumulator with Register/Memory 
Multiplier - Byte 
-Word 
- Doubleword 


F [01 lw] [mod 100 r/m] 


x - 


- - - - - - x 


3/5 
3/5 
7/9 


7 
7 
13 


3/5 
3/5 
7/9 


7 
7 
13 


b 


h 




NEG Negate Integer 


F[011w] [mod Oil r/m] 


x - - 


- X X X X X 


1/3 


5 


1/3 


5 


b 


h 




NOP No Operation 


90 






3 




3 










NOT Boolean Complement 


F[011w] [mod 010 r/m] 






1/3 


5 


1/3 


5 


b 


h 



s 

3 

I 



OR Boolean OR 




0---xxxx0 










b 


h 


Register to Register 


[lOdw] [11 reg r/m] 




1 




1 








Register to Memory 


[lOOw] [modregr/m] 




3 


5 


3 


5 






Memory to Register 


[lOlw] [mod reg r/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8[000w] [mod 001 r/m] # 




1/3 


5 


1/3 


5 






Immediate to Accumulator 


0[110w] # 




1 




1 









OUT Output to Port 
Fixed Port 
Variable Port 


E [01 lw] [port number] 
E [lllw] 




18 
18 


00 00 


4\17 
4\17 


4\18 
4\18 




m 




OUTS Output String 


6 [lllw] 




20 


20 


6\19 


6\19 


b 


h,m 



# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



POP Pop Value off Stack 














b 


h,i,j 


Register/Memory 


8F [mod 000 r/m] 




3/5 


4/5 


3/5 


4/5 






Register (short form) 


5 [1 reg] 




3 


4 


3 


4 






Segment Register (ES, CS, SS, DS) 


[000 sreg2 110] 




4 


5 


18 


19 






Segment Register (ES, CS, SS, DS, FS, GS) 


OF [10 sreg3 001] 




4 


5 


18 


19 







POPA Pop All General Registers | 61 | - - - | 18 | 18 | 18 | 18 | b | h 



| POPF Pop Stack into FIAGS 



9D 



h,n 



S 
I 



5 



PREFIX BYTES 

Assert Hardware LOCK Prefix 
Address Size Prefix 
Operand Size Prefix 
Segment Override Prefix 

CS 

DS 

ES 

FS 

GS 

SS 



PUSH Push Value onto Stack 














b 


h 


Register/Memory 


FF [mod 110 r/m] 




2/4 


4 


2/4 


4 






Register (short form) 


5 [0 reg] 




2 


2 


2 


2 






Segment Register (ES, CS, SS, DS) 


[000 sreg2 110] 




2 


2 


2 


2 






Segment Register (ES, CS, SS, DS, FS, GS) 


OF [10sreg3 000] 




2 


2 


2 


2 






Immediate 


6[10s0] # 




2 


2 


2 


2 







PUSHA Push All General Registers 



I PUSHF Push FLAGS Registei 



9C 



= immediate data 
= 8-bit displacement 



= 16-bit displacement 

= 32-bit displacement (full) 



modified 
unchanged 



Ul 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 






OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 




RCL Rotate Through Carry Left 
Register/Memory by 1 
Register/Memory by CL 
Register/Memory by Immediate 


D [OOOw] [mod 010 r/m] 
D[001w] [mod 010 r/m] 
C[000w] [mod 010 r/m] # 


X-------X 


9/9 
9/9 
9/9 


10 
10 
10 


9/9 
9/9 
9/9 


10 
10 
10 


b 


h 



RCR Rotate Through Carry Right 
Register/Memory by 1 
Register/Memory by CL 
Register/Memory by Immediate 


D [OOOw] [mod 011 r/m] 
D [OOlw] [mod 011 r/m] 
C[000w] [mod 011 r/m] # 


x - - - 


- - - X 


9/9 
9/9 
9/9 


10 
10 

. 10 


9/9 
9/9 
9/9 


10 
10 
10 


b 


h 




REP INS Input String 


F2 6[110w] 




20+9n 


20+9n 


5+9n\ 
18+9n 


5+9n\ 
19+9n 


b 


h,m 



REP LOPS Load String | F2 A[110w] | - - - - | 4+5n | 4+5n | 4+5n | 4+5n | b | h 



REP MOVS Move String | F2 A [OlOw] | --------- | 5+4n | 5+4n | 5+4n | 5+4n | b | h 



REP OUTS Output String 


F2 6[lllw] 




20+4n 


20+4n 


5+4n\ 
18+4n 


5+4n\ 
19+4n 


b 


h,m 




REP STOS Store String 


F2 A[101w] 




3+4n 


3+4n 


3+4n 


3+4n 


b 


h 



REPE CMPS Compare String 


F3 A[011w] 


x - 


- X X X X X 


5+8n 


5+8n 


5+8n 


5+8n 


b 


h 


(Find non-match) 





















REPE SCAS Scan String 


F3 A[lllw] 


x - 


- - X X X X X 


4+5n 


4+6n 


4+5n . 


4+6n 


b 


h 


(Findnon-AUAX/EAX) 





















REPNE CMPS Compare String 


F2 A[011w] 


x - 


- X X X X X 


5+8n 


5+8n 


5+8n 


5+8n 


b 


h 


(Find match) 





















REPNE SCAS Scan String 


F2 A[lllw] 


x - 


- X X X x x 


4+5n 


4+6n 


4+5n 


4+6n 


b 


h 


(Find AL/AX/EAX) 





















# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement - = unchanged 

(full) 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



RET Return from Subroutine 














b 


g>h,j,k,r 


Within Segment 


C3 




10 




10 








Within Segment Adding Immediate to SP 


C2 ++ 




10 




10 








Intersegment 


CB 




13 


13 


26 


26 






Intersegment Adding Immediate to SP 


CA ++ 




13 


13 


26 


27 






Protected Mode: Different Privilege Level 


















Intersegment 










69 


72 






Intersegment Adding Immediate to SP 










69 


72 







ROL Rotate Left 




X-------X 










b 


h 


Register/Memory by 1 


D [OOOw] [mod 000 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


D [00 lw] [mod 000 r/m] 




3/5 


' 7 


3/5 


7 






Register/Memory by Immediate 


C [OOOw] [mod 000 r/m] # 




2/4 


6 


2/4 


6 







ROR Rotate Right 




X-------X 










b 


h 


Register/Memory by 1 


D [OOOw] [mod 001 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


D [00 lw] [mod 001 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C[000w] [mod 001 r/m] # 




2/4 


6 


2/4 


6 







RSDC Restore Segment Register and Descriptor 



RSLDT Restore LDTR and Descriptor 



RSM Resume from SMM Mode 



RSTS Restore TSR and Descriptor 



SAHF Store AH inFlAGS 



OF 79 [mod sreg3 r/m] 



OF 7B [mod 000 r/m] 



OF AA 



OF 7D [mod 000 r/m] 



X X - X X 



= immediate data 
= 8-bit displacement 



= 16-bit displacement 
= 32-bit displacement 



: = modified 
= unchanged 



58 



14 



SAL Shift Left Arithmetic 






X---XX-XX 














Register/Memory by 1 


D [OOOw] 


[mod 100 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


D [OOlw] 


[mod 100 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C [OOOw] 


[mod 100 r/m] # 




2/4 


6 


2/4 


6 







SAR Shift Right Arithmetic 






X-7-XXXXX 














Register/Memory by 1 


D [OOOw] 


[mod 111 r/m] 




2/4 


6 ' 


2/4 


6 






Register/Memory by CL 


D [OOlw] 


[mod 111 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C [OOOw] 


[mod 111 r/m] # 




2/4 


5 


2/4 


6 







CO 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



SBB Integer Subtract with Borrow 




X---XXXXX 










b 


h 


Register to Register 


1 [lOdw] [llregr/m] 




1 




1 








Register to Memory 


1 [lOOw] [modregr/m] 




3 


• 5 


3 


5 






Memory to Register 


1 [lOlw] [modregr/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8[00sw] [mod011r/m]# 




1/3 


5 


1/3 


5 






Immediate to Accumulator (short form) 


1 [HOw] # 




1 




1 










SCAS Scan String 


A [lllw] 


x - 


- X X X X X 


5 


5 


5 


5 


b 


h 




SETB/SETNAE/SETC Set Byte on Below/Not 

Above or Equal/Carry 
To Register/Memory 


OF 92 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 



SETBE/SETNA Set Byte on Below or 
Equal/Not Above 
To Register/Memory 


OF 96 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 




SETE/SETZ Set Byte on Equal/Zero 
To Register/Memory 


OF 94 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 




SETIVSETNGE Set Byte on Less/Not Greater 
or Equal 
To Register/Memory 


OF 9C [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 




SETLE/SETNG Set Byte on Less or Equal/Not 

Greater 
To Register/Memory 


OF 9E [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 



> 

5 



SETNB/SETAE/SETNC Set Byte on Not 
















h 


Below/ 


OF 93 [mod 000 r/m] 




2/2 


2 


2/2 


2 






Above or Equal/Not Carry 



















To Register/Memory 

# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



SETNBE/SETA Set Byte on Not Below or 
Equal/Above 
To Register/Memory 


OF 97 [mod 000 r/m] 




2/2 


2 


2/2 


2. 




h 




SETNE/SETNZ Set Byte on Not Equal/Not 
Zero 

To Register/Memory 


OF 95 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 



SETNL/SETGE Set Byte on Not Less/Greater 
or Equal 
To Register/Memory 


OF 9D [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 




SETNLE/SETG Set Byte on Not Less or 
Equal/Greater 
To Register/Memory 


OF 9F [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 




SETNO Set Byte on Not Overflow 
To Register/Memory 


OF 91 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 



SETNP/SETPO Set Byte on Not 
Parity/Parity Odd 
To Register/Memory 


OF 9B [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 




SETNS Set Byte on Not Sign 
To Register/Memory 


OF 99 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 



SETO Set Byte on Overflow 
To Register/Memory 


OF 90 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 




SETP/SETPE Set Byte on Parity/Parity Even 
To Register/Memory 


OF 9A [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 



# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement (full) - = unchanged 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



SETS Set Byte on Sign 
To Register/Memory 


OF 98 [mod 000 r/m] 




2/2 


2 


2/2 


2 




h 




SGDT Store GDI Register 
To Register/Memory 


OF 01 [mod 000 r/m] 




6 


6 


6 


6 


b,c 


h 



SHL Shift Left Logical 




X---XX-XX 










b 


h 


Register/Memory by 1 


D [OOOw] [mod 100 r/m] 




2/4 


6 


2/4 


6 






Register/Memory by CL 


D [OOlw] [mod 100 r/m] 




3/5 


7 


3/5 


7 






Register/Memory by Immediate 


C[000w] [mod 100 r/m] # 




2/4 


6 


2/4 


6 







SHLD Shift Left Double 
Register/Memory by Immediate 
Register/Memory by CL 


OF A4 [mod reg r/m] # 
OF A5 [mod reg r/m] 




- X X - 


X X 


1/3 
3/5 


5 
7 


1/3 
3/5 


5 
7 








SHR Shift Right Logical 
Register/Memory by 1 
Register/Memory by CL 
Register^Memory by Immediate 


D [OOOw] [mod 101 r/m] 
D [OOlw] [mod 101 r/m] 
C[000w] [mod 101 r/m] # 


x - 


- - X X 


- X X 


2/4 
3/5 
2/4 


6 
7 
5 


2/4 
3/5 
2/4 


6 
7 
6 


b 


h 



SHRD Shift Right Double 




- - - - X X - X X 














Register/Memory by Immediate 


OF AC [mod reg r/m] # 




1/3 


5 


1/3 


5 






Register/Memory by CL 


OF AD [mod reg r/m] 




3/5 


7 


3/5 


7 







SIDT Store IDT Register 














b,c 


h 


To Register/Memory 


OF 01 [mod 001 r/m] 




6 


6 


6 


6 







SLDT Store LDT Register 
To Register/Memory 


OF 00 [mod 000 r/m] 








1/2 


2 


a 


h 




SMSW Store Machine Status Word 


OF 01 [mod 100 r/m] 




1/2 


2 


1/2 


2 


b,c 


h,l 



# = immediate data ++ = 16-bit displacement x = modified 

+ = 8-bit displacement +++ = 32-bit displacement - = unchanged 

(full) 




5' 

3 

(ft 
O 
*i 

(A 

e 

3 

S 
s 

3 



INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE CLOCK 
COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 


OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



I STC Set Carry Flag 



STD Set Direction Flag 



| STI Set Interrupt Flag 



FB 



STOS Store String 


A [lOlw] 




3 


3 


3 


3 


b 


h 




STR Store Task Register 
To Register/Memory 


OF 00 [mod 001 r/m] 








1/2 


2 


a 


h 



1 

s 



SUB Integer Subtract 




X---XXXXX 










b 


h 


Register to Register 


2 [lOdw] [11 regr/m] 




1 




1 








Register to Memory 


2 [lOOw] [mod regr/m] 




3 


5 


3 


5 






Memory to Register 


2 [lOlw] [mod regr/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8 [OOsw] [mod 101 r/m] # 




1/3 


5 


1/3 


5 . 






Immediate to Accumulator (short form) 


2[110w]# 




1 




1 









| SVDC Save Segment Register and Descriptor | pp -jq [mod sreg3 r/m] 



SVLDT Save LDTR and Descriptor 



OF 7A [mod 000 r/m] 



22 



I SVTS Save TSR and Descriptor 



OF 7C [mod 000 r/m] 



■ 



TEST Test Bits 

Register/Memory and Register 
Immediate Data and Register/Memory 
Immediate Data and Accumulator 


8 [OlOw] [mod reg r/m] 
F [01 lw] [mod 000 r/m] # 
A[100w]# 


- - - x x - x 


1/3 
1/3 
1 


5 
5 


1/3 
1/3 
1 


5 
5 


b 


h 




VERR Verify Read Access 
To Register/Memory 


OF 00 [mod 100 r/m] 


- - - - - x - - - 






9/10 


12 


a 


g> h 0'.P 



= immediate data ++ = 16-bit displacement 

= 8-bit displacement +++ = 32-bit displacement 
(full) 



modified 
unchanged 



w 

IK) 


INSTRUCTION 


OPCODE 


FLAGS 


REAL 
MODE 
CLOCK COUNT 


PROTECTED 
MODE CLOCK 
COUNT 


NOTES 








OF DF IF TF SF ZF AF PF CF 


Reg/ 
Cache Hit 


Cache 
Miss 


Reg/ 
Cache Hit 


Cache 
Miss 


Real 
Mode 


Protected 
Mode 



VERW Verify Write Access 




- - - - - x - - - 










a 


g> h 0>P 


To Register/Memory 


OF 00 [mod 101 r/m] 








9/10 


12 







15? 



WAIT Wait Until FPU Not Busy 



WBINVD Write-Back and Invalidate Cache OF 09 



XADD Exchange and Add 




X---XXXXX 














Register! , Register2 


0FC [OOOw] [11 reg2regl] 




3 




3 








Memory, Register 


OF C [OOOw] [mod reg r/m] 




6 


6 


6 


6 







3 



> 

3 



XCHG Exchange 
Register/Memory with Register 
Register with Accumulator 


8 [01 Iw] [mod reg r/m] 

9 [0 reg] 




3/4 
3 


4 


3/4 
3 


4 


b,f 


f,h 




XLAT Translate Byte 


D7 




3 


5 


3 


5 




h 



XOR Boolean Exclusive OR 






- - - x x - x 










b 


h 


Register to Register 


3 [OOdw] 


[11 reg r/m] 




1 




1 








Register to Memory 


3 [OOOw] 


[mod reg r/m] 




3 


5 


3 


5 






Memory to Register 


3 [OOlw] 


[mod reg r/m] 




3 


5 


3 


5 






Immediate to Register/Memory 


8 [OOsw] 


[mod 110 r/m] # 




1/3 


5 


1/3 


5 






Immediate to Accumulator (short form) 


3 [OlOw] 


# 




1 




1 









# = immediate data 
+ = 8-bit displacement 



■■ 16-bit displacement 
■ 32-bit displacement 



modified 
unchanged 



Instruction Notes for Instruction Set Summary 
Notes a through c apply to Real Address Mode only: 

a. This is a Protected Mode instruction. Attempted execution in Real Mode will result in exception 6 (invalid op-code). 

b. Exception 13 fault (general protection) will occur in Real Mode if an operand reference is made that partially or fully extends beyond the maximum CS, DS, ES, FS, or GS segment limit 
(FFFFH). Exception 12 fault (stack segment limit violation or not present) will occur in Real Mode if an operand reference is made that partially or fully extends beyond the maximum 
SS limit. 

c. This instruction may be executed in Real Mode. In Real Mode, its purpose is primarily to initialize the CPU for Protected Mode. 



Instruction Notes for Instruction Set Summary (Continued) 



Notes e through g apply to Real Address Mode and Protected Virtual Address Mode: 

e. An exception may occur, depending on the value of the operand. 

f. LOCK# is automatically asserted, regardless of the presence or absence of the LOCK prefix. 

g. LOCK# is asserted during descriptor table accesses. 

Notes h through r apply to Protected Virtual Address Mode only: 

h. Exception 13 fault will occur if the memory operand in CS, DS, ES, FS, or GS cannot be used due to either a segment limit violation or an access rights violation. If a stack limit is 
violated, an exception 12 occurs. 

i. For segment load operations, the CPL, RPL, and DPL must agree with the privilege rules to avoid an exception 13 fault. The segment's descriptor must indicate "present" or exception 
11 (CS, DS, ES, FS, GS not present). If the SS register is loaded and a stack segment not present is detected, an exception 12 occurs. 

j. - All segment descriptor accesses in the GDT or LDT made by this instruction will automatically assert LOCK# to maintain descriptor integrity in multiprocessor systems, 
k. JMP, CALL, INT, RET, and IRET instructions referring to another code segment will cause an exception 13, if an applicable privilege rule is violated. 
1. An exception 13 fault occurs if CPL is greater than (0 is the most privileged level), 
m. An exception 13 fault occurs if CPL is greater than IOPL. 

n. The IF bit of the flag register is not updated if CPL is greater than IOPL. The IOPL and VM fields of the flag register are updated only if CPL = 0. 

o. The PE bit of the MSW (CRO) cannot be reset by this instruction. Use MOV into CRO if desiring to reset the PE bit. 

p. Any violation of privilege rules as apply to the selector operand does not cause a Protection exception, rather, the zero flag is cleared. 

q. If the coprocessor's memory operand violates a segment limit or segment access rights, an exception 13 fault will occur before the ESC instruction is executed. An exception 12 fault 

will occur if the stack limit is violated by the operand's starting address, 
r. The destination of a JMP, CALL, INT, RET, or IRET must be in the defined limit of a code segment or an exception 13 fault will occur. 
^ s. All memory accesses using this instruction are non-cacheable as this instruction uses SMM address space. 
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I 



Notes 



CYRIX Cx486SLC/e MICROPROCESSOR 



High-Performance 486-Style CPU with Advanced Power 
Management for Notebook or Battery Powered Systems 




A.I Cx486SLC/e Stepping 
Revision History 

The Cx486SLC/e is an enhanced version of the 
Cx486SLC that adds System Management Mode 
circuity including two new pins: SMI# (pin 47) 
and SMADS# (pin 20). 

Also included are seven new software instruc- 
tions: SVDC, RSDC, SVLDT, SVTS, RSTS, and 
RSM. Stepping identification can be performed by 
reading the initialized state of the EDX register 
(bits 15-0). The EDX register data is listed in 
Table A-1. 



Table A-1. Cx486SLC Stepping 



STEPPING 


EDX 
REGISTER 


DESCRIPTION 


Cx486SLC 
Cx486SLC/e 


0410 
0411 


Original feature set 
SMM feature added 



A.2 Manual Revision History 

This manual (94069-00) replaces manual 
(94073-00) and applies Cx486SLC (except SMM 
mode features) and the Cx486SLC/e. The new 
features are described as well as many other 
updates and improvements have been made. The 
following items have been significantly revised: 

Cover Page 

Changed to reflect new features. 
Section 1.5 

Inclusion of system management mode informa- 
tion has been made to this section. 

Section 1.6 

Figure 1-1 includes SMADS# and SMI# signals. 
Section 2.1 

In Table 2-1 the four NCR registers in the previ- 
ous manual have been renamed as ARR registers 
as the meaning of these registers changed. 
Within Table 2-1 the initialized contents of the 
EDX, CR0, CCR1 and DR7 have been corrected 
and updated. 

Section 2.3.2 

Figure 2-5 contains AARn registers replacing 
NCRn registers. Description of TR6 and TR7 has 
been corrected. 



A-1 



Cyrix 

. Advancing the Standards 



Manual Revision History 



Section 2.3.2.4 

This section was re-written to reflect SMM 
additions. The ARRn registers are described. 

Section 2.5 

Section 2.5 and its sub-sections were re-written 
include SMM information. 

Section 2.6 

This section is new and provides detailed system 
management mode information. The section 
describes the SMM memory space, the SMM 
header and the SMM instruction set. 

Section 3.1 

Figure 3-1 now shows the signals in the order 
they are described as well as includes the addi- 
tional signals used for SMM operations. 
Table 3-1 include SMM signals. 

Section 3.2.6 

SMADS# paragraph included. 

Section 3.2.7 

SMI# paragraph included. 

Section 3.2.11 

Tables 3-5 and 3.2.12 corrected and updated. 
Section 3.3.10 

This is a new section and describes the SMM 
interface. Within this section the SMM bus 
timing and the SMM I/O trap mechanism are 
described. 



Section 4.1.2 

Pull-up resistor for SMI# added to Table 4-1. 
Section 4.4 

33 MHz information added to Table 4-5. 
Section 4.5 

SMADS# and SMI# timing information added to 
Figures 4-1, 4-3, 4-4 and 4-7 and also to 
Tables 4-7, 4-8, 4-9. Figure 4-9 is new and 
provides 33 MHz AC characteristics. 

Section 5.1 

Figure 5-1, Tables 5-1 and 5-2 include the 
SMADS# and SMI# pins. 

Section 5.3 

The section has been corrected and updated. 
Tables 5-4 and 5-5 have been added to provide 
airflow as related to ambient temperature for 
various clock frequencies. 

Section 6.4.2 

Table 6-16 includes the SVDC, SVLDT, SVTS 
RSDC, RSLDT, RSTS and RSM instructions. 



A-2 



PRELIMINARY 



Ordering Information 



A 



A.3 Ordering Information 



CX 486SLC/e-V 33 Q P 



Cyrix Prefix 

Device Name 
486SLC/e 

Voltage 

Blank = 5 volts 
V = 3 volts 

Speed 

20 = 20 MHz 
25 = 25 MHz 
33 = 33 MHz 



Package Type 

Q = Quad Flat Pak 

Temperature Range 
P = Commercial 



The currently available Cyrix Cx486SLC/e part numbers are listed below: 



Cx486SLC/e Part Numbers 



PART NUMBER 


DESCRIPTION 


Cx486SLC/e-25-QP 


5 V, 25 MHz, QFP Package 


Cx486SLC/e-33-QP 


5 V, 33 MHz, QFP Package 


Cx486SLC/e-V20-QP 


3 V, 20 MHz, QFP Package 


Cx486SLC/e-V25-QP 


3 V, 25 MHz, QFP Package 



PRELIMINARY 



A-3 



Cyrix 

J/g Advancing the Standards 



INDEX 



AC Characteristics, 4-5 
Addresses 

address bus, 3-4 

address space, 2-32 

offset address calculation, 2-34 

B 



Floating CPU signals using FLT#, 3-44 



Bus 

bus arbitration, 3-9 

bus cycles using non-pipelined addressing, 3-14 
bus cycles using pipelined addressing, 3-18 
bus interface overview, 3-1 
bus operation, 3-14 
bus state diagram, 3-25 

Byte Enable Lines (BLE#, BHE#), 3-4 



Cache Interface 

cache flushing, 3-31 

internal cache interface signals, 3-7 

internal cache timing, 3-30 
Clock 

2X clock input signal, 3-3 

clock count assumptions, 6-10 

clock waveform measurement points, 4-7 

stopping the input clock, 3-43 



Coprocessor Interface 
signals, 3-8 
timing, 3-37 



Gate Descriptors, 2-18 

Gates and Privilege Transfers, 2-57 

H 



Halt (HLT) and Shutdown due to Errors, 2-53 
Halt and Shutdown Timing Cycles, 3-27 
Hold Acknowledge (HLDA), 3-9 
Hold Acknowledge State, 3-33 



I/O Address Space, 2-32 

Initialization, 2-1 

Instruction Set Formats, 6-1 

Instruction Timing, 6-13 

Interrupt Acknowledge (INTA) Cycles, 3-26 

Interrupts 

abort exceptions, 2-41 

exceptions, 2-41 

fault execeptions, 2-41 

hardware/software, 2-44 

interrupt pins, NMI, INTR, SMI# 2-40 

interrupt vectors, 2-41 

INTR interrupts, 2-40 

NMI interrupts, 2-40 

priorities, 2-43 

SMI interrupt, 2-47 

real mode and exceptions, 2-45 

trap exceptions, 2-41 



Data Bus Signals, 3-4 

DC Characteristics, 4-4 

Descriptor Table and Segment Selectors, 2-7 

Descriptors, Segment and Gate, 2-16 



Exceptions, Trap, Fault and Abort, 2-41 



Lock Prefix for Instructions, 2-3 
Locked Bus Cycles, 3-26 

M- 



Maximum Temperature and Voltage Ratings, 4-2 
Mechanical Drawing of 100-pin BQFP Package, 5-4 
Memory and I/O Address Spaces, 2-32 
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PRELIMINARY 



Index 



A 



INDEX 



Modes 

HALT initiated suspend modesuspend, 3-42 
memory addressing modes table, 2-34 
protected mode addressing mode, 2-35 
real mode addressing mode, 2-35 
SUSP# initiated suspend mode, 3-41 
virtual 8086, 2-58 

O ■ 

Offset Address Calculation, 2-34 
Operating Conditions, Recommended 4-3 

P 

Package Drawing (100-pin BQFP), 5-4 
Paging Mechanism, 2-37 
Pin Assignments, 5-1 
Pins, Unused and N/C Input, 4-2 
Pipelined Addressing, 3-18 
Pipelined Cycles and Wait States, 3-20 
Power and Ground Considerations, 4-1 
Power Management Interface , 3-10 
Power Management Timing, 4-41 
Privilege Level Field in Segment Selector, 2-8, 
Privilege Levels (DPL, CPL, RPL), 2-55 
Protection, Segment and Page, 2-53 
Pull-Up and Pull-Down Resistors, 4-1 

R 

Registers 

address region registers, 2-22 
application register set, 2-4 
cache test register, 2-30 
configuration control registers, 2-22 
control registers, 2-13 
data registers, 2-4 
debug registers, 2-26 

descriptor table registers and descriptors, 2-15 
flags register (EFLAGS), 2-9 
global descriptor table register, 2-15 
interrupt descriptor table register, 2-15 
instruction pointer register, 2-9 
local descriptor table register, 2-15 
pointer and index register, 2-5 



segment registers and selectors, 2-7 

system register set, 2-11 

task register, 2-19 

test register, 2-28 
Requested Privilege Level (RPL), 2-8 
RESET 

RESET setup and hold timing, 4-14 

RESET timing, internal clock synchronization, 3-12 

signal status during reset, 3-3 

S : ; 

Segment Selector, 2-7 
Segment Descriptor, 2-7 
Selector Address Mechanism, 2-36 
Selectors, Code, Data and Stack 2-7 
Setup and Hold Timing, 4-11 
Signals 

A23-A1, 3-4 

A20M#, 3-8, 

A20M# timing, 3-32 

ADS#, 3-5 

BHE#, 3-4 

BLE#, 3-4 

BUSY#, 3-8 

D15-D0, 3-4 

D/C#, 3-4 

ERROR#, 3-8 

FLT#, 3-12 

FLUSH#, 3-7 

HLDA, 3-9 

HOLD, 3-9 

INTR, 2-40,3-6 

KEN#, 3-7 

LOCK#, 3-4 

M/IO#, 3-4 

NA#, 3-6 

NMI," 2-40, 3-6 

PEREQ, 3-8 

READY#, 3-6 

RESET, 3-3 

RPLSET, 3-7 

RPLVAL#, 3-7 



PRELIMINARY 



A- 5 



Index 



INDEX 



SMADS#, 3-6 

SMI#, 3-6 

SUSP#, 3-10 

SUSPA#, 3-10 

W/R#, 3-4 
Signal Summary, 3-2 
Signals Unique to Cx486SLC/e, 1-4 
SMI Service Routine Execution, 2-52 
SMM Interface, 3-38 
SMM Instructions, 2-51 
SMM Memory Space, 2-52 
SMM Memory Space Header, 2-49 
SMM Operation, 2-48 
Suspend Mode, 3-41 
System Managment Mode (SMM), 2-47 

T = 

Thermal Characteristics, 5-5 
Translation Look-Aside Buffer, 2-39 

W 

Wait States, Non-Pipelined, 3-17 
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